neconyd | f55e5150c0b9c8fc09bc79ed8dd53fe094fef3550289b9326c8e1dd8619d6f94

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
Size

64KB
MD5

14e8b4d4b8f22343b05b0f84a9c42289
SHA1

910fc3e313b8f1390a34af7db5e305ae9d880d13
SHA256

f55e5150c0b9c8fc09bc79ed8dd53fe094fef3550289b9326c8e1dd8619d6f94
SHA512

f2869e8d1cf140b1506ff5d2cc9cb2715148a87cf895fd0d5b1df355834fea8df0554a90fc2f82cd57f7cc40d5131dd16418733af9aafa611eda44a502799e1b
SSDEEP

1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1788	omsecor.exe
2500	omsecor.exe
2976	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
1788	omsecor.exe
1788	omsecor.exe
2500	omsecor.exe
2500	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1788	1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	28
PID 1032 wrote to memory of 1788	1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	28
PID 1032 wrote to memory of 1788	1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	28
PID 1032 wrote to memory of 1788	1032	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	28
PID 1788 wrote to memory of 2500	1788	omsecor.exe	32
PID 1788 wrote to memory of 2500	1788	omsecor.exe	32
PID 1788 wrote to memory of 2500	1788	omsecor.exe	32
PID 1788 wrote to memory of 2500	1788	omsecor.exe	32
PID 2500 wrote to memory of 2976	2500	omsecor.exe	33
PID 2500 wrote to memory of 2976	2500	omsecor.exe	33
PID 2500 wrote to memory of 2976	2500	omsecor.exe	33
PID 2500 wrote to memory of 2976	2500	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
103c7abc511a66a506cf0fbedaa0b581

SHA1
2cc79ba19b607ae1ef43b6a1a4d6477b709bf334

SHA256
8f23feb9b2b6cdb770ef4ea83c069681a9eaa1afcd81a90eeb109621bdf99027

SHA512
1d9ff8fc6f85581ff91bee36fbc4726833a0e323aa661c1b5b2ee07fd2271f38f02251538dd630d8b530aa5b7986b909fbaad90ab65c515afd6b3a7305a0afad

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
144f064cc7efaf0a2e230e13d522930a

SHA1
d3d16b6ba5d03e2e35fff87cf46061683210f081

SHA256
9c0a7515e36ece9cfd75525ca6a1836686628d2f30247da094de834573aa6359

SHA512
dec02b304b88501469849c663455b6bbac98f0f4fadc4a498cff5b6a2802077f6bae721eca795bc1f60d30a0ce9994482aa0f64f03fea7e8ea127f9b15d48284

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
eb30bab57e01738e89c34034aa83a46f

SHA1
a39397846f1f45b0eb40f42f50a3769537864935

SHA256
bb80bde1b012b91853197cec42a134dcf9b44f474712912d50fbdf4220f6ee14

SHA512
a45ea3e796ec0a932fab65509166451a99d388fa56d1719cbd21892c20f28319ba2711a06c01e24ad327dea3b34ec633caad1036011f61f585095b8bc88eaa1f

Download Submit