neconyd | cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe
Size

64KB
MD5

df01b9df52d25b93a9e8a294e2f8c765
SHA1

7ea09ab708f67a4d771e146733ce9fcce3fc8c48
SHA256

cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a
SHA512

7daaa253d2604aa7d19e5cca4980ae68eb174f7aa279e61e55043591ac5e18c88516bb104c90df1ac11776bb07bcf36bc4639de6b6f0a605e465d94eeb5c5145
SSDEEP

768:eMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:ebIvYvZEyFKF6N4yS+AQmZcl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2420	omsecor.exe
5000	omsecor.exe
4696	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2420	4296	cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe	83
PID 4296 wrote to memory of 2420	4296	cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe	83
PID 4296 wrote to memory of 2420	4296	cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe	83
PID 2420 wrote to memory of 5000	2420	omsecor.exe	100
PID 2420 wrote to memory of 5000	2420	omsecor.exe	100
PID 2420 wrote to memory of 5000	2420	omsecor.exe	100
PID 5000 wrote to memory of 4696	5000	omsecor.exe	101
PID 5000 wrote to memory of 4696	5000	omsecor.exe	101
PID 5000 wrote to memory of 4696	5000	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe
"C:\Users\Admin\AppData\Local\Temp\cf8866ac3de88b717426947d1ff38e0d05c3d351866f4bb7935476669aa1f80a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
2e2a7ae62f4638f25cc70b02534abd37

SHA1
79371b3ad46626ca617c8555f427bbeea4fb7313

SHA256
f7646380f35da547614dee461accf8f73ae0a1f26516ac788c9b125e0b1cd8fb

SHA512
1c88c00f829d7ac9a2531c6aa4ae3f1b9743e54fa59452bb5b2d437f8c990fc993ea65733e2a808647ae7086afc694142e551ca23d932386c841206de74c4e94

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
b999f49b3f983dfc8e8c53fe683adc5e

SHA1
8f7657b1941d924bf1d26080de19662331ed03ed

SHA256
6250bf27f87cf6842a7e04e3fedb5153a224cc619e68710b514b4d4a1da9b310

SHA512
965be3a59b260dd3556345b9aca82bca86a4bacf186a191620c31350a2c8e5c2c35acb65fc10cd13ff1fa5697fc33ee536ffcfc2374e16657687912a6da9487b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
54d7dd75cce1e335397d43a0e6fe0cd7

SHA1
5da4b6bfc08139c1e0e368b7bac1596e5423e6c7

SHA256
dfb3b598fd59443e66ffaf01e042a52e232474f343414a4abc8039bf32c7099d

SHA512
fda6bcf1b964cdbf42cc8e9ec4b7c0324b207f0122717319aeb685f125da6bf72677494301602d465929f3e4b6db7aac85e97ed4c1501e42fe5684a8d8030fd3

Download Submit