neconyd | f55e5150c0b9c8fc09bc79ed8dd53fe094fef3550289b9326c8e1dd8619d6f94

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
Size

64KB
MD5

14e8b4d4b8f22343b05b0f84a9c42289
SHA1

910fc3e313b8f1390a34af7db5e305ae9d880d13
SHA256

f55e5150c0b9c8fc09bc79ed8dd53fe094fef3550289b9326c8e1dd8619d6f94
SHA512

f2869e8d1cf140b1506ff5d2cc9cb2715148a87cf895fd0d5b1df355834fea8df0554a90fc2f82cd57f7cc40d5131dd16418733af9aafa611eda44a502799e1b
SSDEEP

1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1052	omsecor.exe
5068	omsecor.exe
2012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 1052	412	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	83
PID 412 wrote to memory of 1052	412	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	83
PID 412 wrote to memory of 1052	412	JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe	83
PID 1052 wrote to memory of 5068	1052	omsecor.exe	99
PID 1052 wrote to memory of 5068	1052	omsecor.exe	99
PID 1052 wrote to memory of 5068	1052	omsecor.exe	99
PID 5068 wrote to memory of 2012	5068	omsecor.exe	100
PID 5068 wrote to memory of 2012	5068	omsecor.exe	100
PID 5068 wrote to memory of 2012	5068	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14e8b4d4b8f22343b05b0f84a9c42289.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
f799759a552fa7b92f73dbc8106f01bf

SHA1
aea09ba4addef09bfd60e1afd4cd6aea02b67f5f

SHA256
19d3a0e42d4869fb075dc4e1cd7488947c0bfa4c33a673aa0cdd91f8f2d3828c

SHA512
938168badacfed858a1c0a7f19598fd0bee876e188be033fbd9aee85d846de606c42d1cf57a758b29295ec0d9f9aca0cea0c9656bb3e18be9193299d26f74bf7

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
103c7abc511a66a506cf0fbedaa0b581

SHA1
2cc79ba19b607ae1ef43b6a1a4d6477b709bf334

SHA256
8f23feb9b2b6cdb770ef4ea83c069681a9eaa1afcd81a90eeb109621bdf99027

SHA512
1d9ff8fc6f85581ff91bee36fbc4726833a0e323aa661c1b5b2ee07fd2271f38f02251538dd630d8b530aa5b7986b909fbaad90ab65c515afd6b3a7305a0afad

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
3310a8b735dc4f3215357a8804788348

SHA1
108ca90375a6c9062d0733a88b236d451ea4e731

SHA256
2405009cf134f3cfe6bcbb4abb9a8f0fd48a366e18cbca23e6213b47a928b607

SHA512
ddbd84e5863e7bed2280fa107fd788885a5bfcf67342d1f6664047dce71b3a076fdde3ff245a5b1c9805338602df8c8dc31efd18820b8046b2bd8bc0b0a7e149

Download Submit