neconyd | 7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
Size

96KB
MD5

25010824fed38e2ca5cba1fad94fb28c
SHA1

4c571f8c16026f1223812598ce38654a9f7d5bf6
SHA256

7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0
SHA512

c6e4c68647d39c09920c29769f96182634e21c53f92e5e1e05004c8220c04a5a17a8f03fc1dc1bf2ea116c5bb5ad73d299014740ac8936565869c8f81df805ea
SSDEEP

1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:1Gs8cd8eXlYairZYqMddH13B

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2668	omsecor.exe
2704	omsecor.exe
1088	omsecor.exe
1624	omsecor.exe
696	omsecor.exe
380	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
2668	omsecor.exe
2704	omsecor.exe
2704	omsecor.exe
1624	omsecor.exe
1624	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2668 set thread context of 2704	2668	omsecor.exe	33
PID 1088 set thread context of 1624	1088	omsecor.exe	36
PID 696 set thread context of 380	696	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2084 wrote to memory of 2776	2084	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	31
PID 2776 wrote to memory of 2668	2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	32
PID 2776 wrote to memory of 2668	2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	32
PID 2776 wrote to memory of 2668	2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	32
PID 2776 wrote to memory of 2668	2776	7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe	32
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2704 wrote to memory of 1088	2704	omsecor.exe	35
PID 2704 wrote to memory of 1088	2704	omsecor.exe	35
PID 2704 wrote to memory of 1088	2704	omsecor.exe	35
PID 2704 wrote to memory of 1088	2704	omsecor.exe	35
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1088 wrote to memory of 1624	1088	omsecor.exe	36
PID 1624 wrote to memory of 696	1624	omsecor.exe	37
PID 1624 wrote to memory of 696	1624	omsecor.exe	37
PID 1624 wrote to memory of 696	1624	omsecor.exe	37
PID 1624 wrote to memory of 696	1624	omsecor.exe	37
PID 696 wrote to memory of 380	696	omsecor.exe	38
PID 696 wrote to memory of 380	696	omsecor.exe	38
PID 696 wrote to memory of 380	696	omsecor.exe	38
PID 696 wrote to memory of 380	696	omsecor.exe	38
PID 696 wrote to memory of 380	696	omsecor.exe	38
PID 696 wrote to memory of 380	696	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
"C:\Users\Admin\AppData\Local\Temp\7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
  C:\Users\Admin\AppData\Local\Temp\7c49c8d862332ed00640dfa7ea7c4b22c46455f64b6b6c09bd8425b3f2f531a0.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b40f2d66eecd5c396c94bc245d0c13fe

SHA1
b2dca0ec48fe62dc3819cc063ddb04fc80925e24

SHA256
4fadda8f37a7732dd377cb48a99b681fbbc6fde23ec8c55ccfd3ed0669edb27b

SHA512
568a86b4efaca2698fed072c8530a70d7b4a88c25efafefbf046ff0ea08439530b7b141b2ef3d93e397ec77b31303959ccae5b3622e89b5013d2d150ef7eb279

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
52db4e995ed9346b2aef16836044d06c

SHA1
f6b6a6eb3b30420a6de183c21973a5d1859ec1e9

SHA256
0e991238898bca35281a880ede4287b3160380dd8a8138b30e0380e99695d541

SHA512
a43bfe3e2773f0d0cef83b2897ce2534f17eb8a55a48eeacccbd3bcfc692275d959c1b957c67cd16a1eed7f89d4992fcf62ac44347467e99ebfb4b4239510228

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
1be10c4c7e3d1b18de99469308f68440

SHA1
9f4a90894206da64bf0b7d702ac505db17a31e12

SHA256
8e4eb7655b9c816ae8f3230f78a7c72359d8134460b8188ac389f6553e6e5ccf

SHA512
e897d64694dd4d2269e0a831095dca06aefda88285b46c7b5dfd719804277cf781837269b38c82c50eb2a8efc4c1753a3783582dd7d7a4236f1d072cfbb5c8bf

Download Submit
memory/380-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/380-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/696-89-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/696-81-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1088-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1088-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1624-72-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2084-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2084-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2668-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2668-24-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2668-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2704-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-55-0x00000000004A0000-0x00000000004C3000-memory.dmp

Filesize
140KB

Download
memory/2704-53-0x00000000004A0000-0x00000000004C3000-memory.dmp

Filesize
140KB

Download
memory/2704-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download