neconyd | eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe
Size

71KB
MD5

fed1744cabdbcd081f505619aba7ccee
SHA1

116890bc81f04855c587f98c4896397765e7df65
SHA256

eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2
SHA512

8ee8d58b710df5749867ed0dd30a65fe0ed2c4a739de377e5d827f0e29f462ee4fe1ea38918b2fd80f5a16cd7ab2f083fad3eca75f18f96ee9b14736bb233d9d
SSDEEP

1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbHv:hdseIOMEZEyFjEOFqTiQmQDHIbHv

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1664	omsecor.exe
4864	omsecor.exe
1752	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1664	4216	eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe	82
PID 4216 wrote to memory of 1664	4216	eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe	82
PID 4216 wrote to memory of 1664	4216	eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe	82
PID 1664 wrote to memory of 4864	1664	omsecor.exe	92
PID 1664 wrote to memory of 4864	1664	omsecor.exe	92
PID 1664 wrote to memory of 4864	1664	omsecor.exe	92
PID 4864 wrote to memory of 1752	4864	omsecor.exe	93
PID 4864 wrote to memory of 1752	4864	omsecor.exe	93
PID 4864 wrote to memory of 1752	4864	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe
"C:\Users\Admin\AppData\Local\Temp\eb60f629bc961989e5bb2281d42e8d9cb23e1d5574adb2fc7873374b59a637f2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
b56f0976be07b28e819614890245780b

SHA1
5f244c556414185632c4d5f518d084ee525e7e42

SHA256
6fe9c4cf5952f5796488152e21b8852eb87786598b66793f8c264fb922421657

SHA512
9272db879b88cb00cdca7e576b45b71be2df378cb81b935baf0e9786b9c7dce7184aa7e5a198bce7b4b51754a920bd83f5ce3849fe6903786b85a682584f40d9

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
3f04c8433451607a488a677ffb6f5381

SHA1
bd947ccd91408b410f9865978a28742590a2e519

SHA256
24f61a4a46a573fb54a948ca71e342d52ae49258426943effafc93feb35bb01a

SHA512
d33ca5b46437d88a189f101121b94e75f020709aca0b84af5958bd05d1ff51c374ff831e8078773bd66297e32bfb7f6d5e23a3ec163357fa3cc31b49647c5581

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
3ec0fd03e03b27c6f86a891951127fee

SHA1
0fb29c7b9d7bf3d55bae4189a790695a0dfc7d94

SHA256
5c2a54a5f16c10753ca84a656f214c330560f27d678da4059c267265afb26371

SHA512
118db722846003cabe5edf9f7afae115f988e7e005499f2b33828c1a3233f9b7f8b9a5f595e3d74bac5648f92e5d8e15da88a9e8e1e40e814366dd604c218e63

Download Submit
memory/1664-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1664-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1664-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4216-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4216-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4864-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4864-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download