neconyd | e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
Size

72KB
MD5

079298856becc586055d399ad5a5e2f4
SHA1

e71567fa6db0a2f8ec739e304282856306ce2327
SHA256

e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a
SHA512

2e9bb64ccf48e44e69520b838c16ae8df3e5b4ca2f9555a5753412392b3b2f650132c5769c7832132839ba5e80cd10c33ebacb1107f258b2a78eb273880f9449
SSDEEP

1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:CdseIOMEZEyFjEOFqTiQm5l/5211

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3640	omsecor.exe
4672	omsecor.exe
4680	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3640	748	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 748 wrote to memory of 3640	748	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 748 wrote to memory of 3640	748	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 3640 wrote to memory of 4672	3640	omsecor.exe	93
PID 3640 wrote to memory of 4672	3640	omsecor.exe	93
PID 3640 wrote to memory of 4672	3640	omsecor.exe	93
PID 4672 wrote to memory of 4680	4672	omsecor.exe	94
PID 4672 wrote to memory of 4680	4672	omsecor.exe	94
PID 4672 wrote to memory of 4680	4672	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
"C:\Users\Admin\AppData\Local\Temp\e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
cec3936ecd2edf607c124774883bf9d1

SHA1
2d8412803af3eed1204252a7ff082f0e94894142

SHA256
c84acfe33049e398eff9f60f4f05365746b7430bd859f8c1a71f1bdfdc2c9d12

SHA512
d6cd60cb8cd3495593d42f3ea551c3ee08a0170abee1f498a03ae3c6629a9e1147609c162cef73afa9f267ffb1d6229fd418376278dcc0abdc69e2d15db50fdc

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
35cb006f3e89671f47c1279788e7f1a3

SHA1
c6e1c611841c6effe2f08124c733b6908e64feaf

SHA256
db7db8518c27a79ae88f6e50716df62bc8d2b0384992db60b607ee4a7a723719

SHA512
99cc00f9f1e79c2076da0c48136b6e192bcfda01b75a3d0cbe67be06960490646307883c22bbe785d863ebbf822a2cda5458d06e710808958ec23ee05f0b172f

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
a20e24ebef827b71d7b6664f8304e5fe

SHA1
0787f492e8d1a5e171bdaeb2a5ad5805aca7052e

SHA256
c11c8ba0817958b5209a392f4ef03ef3cd9e41dc9c9cea6b2dfd991aae81a8f7

SHA512
22d9f812cc7dcc35aab11c94e1a6cc0ad161deb070f422fd476ca152d379ef735aced2e7763fc26848a01bc9aa98695133f2383dff0d928818485e31ec12399c

Download Submit