neconyd | 9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06

Analysis

max time kernel
114s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe
Size

90KB
MD5

76bb43664d3cadfb344f5cfd88c2356a
SHA1

847b9ac72156ce1fbcbf7540059144aed9719409
SHA256

9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06
SHA512

a0e35ce5d2c0696b9b87de8964527eb2d1f0107239b708d1a81711b894d083bda3133890ccfad88b2c9c248edfa6c824f579c94cd292623313507eb4ea3a054e
SSDEEP

768:uMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uAK:ubIvYvZEyFKF6N4aS5AQmZTl/5y

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2324	omsecor.exe
1968	omsecor.exe
1436	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2324	5036	9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe	83
PID 5036 wrote to memory of 2324	5036	9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe	83
PID 5036 wrote to memory of 2324	5036	9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe	83
PID 2324 wrote to memory of 1968	2324	omsecor.exe	101
PID 2324 wrote to memory of 1968	2324	omsecor.exe	101
PID 2324 wrote to memory of 1968	2324	omsecor.exe	101
PID 1968 wrote to memory of 1436	1968	omsecor.exe	102
PID 1968 wrote to memory of 1436	1968	omsecor.exe	102
PID 1968 wrote to memory of 1436	1968	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe
"C:\Users\Admin\AppData\Local\Temp\9d36448b4bb821ad8659c0e7710498e4d85ca4b25485bb3057af62844eb70b06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
25f4410656cc7ae91803d91c51ae0b01

SHA1
a97cb1c1ff2472a55880a2b5da3a49ca2e5bf985

SHA256
568016c4befd5ddc52874e3c9d13e95d648ea6e7e54ab71b94f57d78bf01836b

SHA512
bd70d750d36292fbe819f26753d33c8dfcd53bec17b92a0e7552c5ccefbcdef2cfde958f4a2ce0d5f3a85d6024a2c8c96361a0fdc1cf5d8217e50d15243739ba

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
c33df7e570355b45860c4e4cdb517576

SHA1
c87a936b6f00ad64df62f6d96c43b529cf1633f0

SHA256
218cefae9539773e76431cc7f50f6bd689f1fa58d5ade23dcbb1cb4faf540b7f

SHA512
ced8353a21a69c77d9f4a6bcc4c7244576e52160c23b084d270330a5987665de0eb3e9de57868364382654ce902b8f302326b665299aa302a09a288266f644e2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
7bd72cace4eb1977d6ad5850f88da18a

SHA1
a34b0babef7ccff8cb43fdf89fd60eb326ab1b25

SHA256
8ccfbf5ab46fadd953cd485c05eea52a913cdfd284f8409719b632b5aa2f8723

SHA512
65bd558d17e02a72bfce7d727ee576333235e190b6ef582ebd7df145c9adddcd83681abea493b087e358e7acf453222b98ef845ed453b6b6bdf68e8e1870c40d

Download Submit
memory/1436-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1436-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1968-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1968-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2324-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2324-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2324-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5036-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5036-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download