neconyd | d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4af

Analysis

max time kernel
114s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
Size

96KB
MD5

cdf57d994164384fb8b40d761e0e8c20
SHA1

b5d25a35f2f60224e5428d74890b00bc42ba645c
SHA256

d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4af
SHA512

843a9b5f48c094854229c6ee3d775134b3fcdc0480f9b01677c40162aa375c5312febd6d54cd8446925481176c0774235fe5d78435ac6e540dfbe9fe2358a6b4
SSDEEP

1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:1Gs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2252	omsecor.exe
3052	omsecor.exe
1288	omsecor.exe
2768	omsecor.exe
2568	omsecor.exe
2020	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
2252	omsecor.exe
3052	omsecor.exe
3052	omsecor.exe
2768	omsecor.exe
2768	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2252 set thread context of 3052	2252	omsecor.exe	30
PID 1288 set thread context of 2768	1288	omsecor.exe	35
PID 2568 set thread context of 2020	2568	omsecor.exe	37

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 2400 wrote to memory of 1316	2400	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	28
PID 1316 wrote to memory of 2252	1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	29
PID 1316 wrote to memory of 2252	1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	29
PID 1316 wrote to memory of 2252	1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	29
PID 1316 wrote to memory of 2252	1316	d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe	29
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 2252 wrote to memory of 3052	2252	omsecor.exe	30
PID 3052 wrote to memory of 1288	3052	omsecor.exe	34
PID 3052 wrote to memory of 1288	3052	omsecor.exe	34
PID 3052 wrote to memory of 1288	3052	omsecor.exe	34
PID 3052 wrote to memory of 1288	3052	omsecor.exe	34
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 1288 wrote to memory of 2768	1288	omsecor.exe	35
PID 2768 wrote to memory of 2568	2768	omsecor.exe	36
PID 2768 wrote to memory of 2568	2768	omsecor.exe	36
PID 2768 wrote to memory of 2568	2768	omsecor.exe	36
PID 2768 wrote to memory of 2568	2768	omsecor.exe	36
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37
PID 2568 wrote to memory of 2020	2568	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
"C:\Users\Admin\AppData\Local\Temp\d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
  C:\Users\Admin\AppData\Local\Temp\d567149e7f9db578098e549c133a64e5ef667e4d8d0162cc0dc8e4843df4f4afN.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
a003f7e5dadc9f7e7cc10eca393a630d

SHA1
faada27f3f9a62b2a12d8c2462971adfb7e97fe2

SHA256
7b999a329c49d47eac6a221b0abbdcf46b771055ce920dcb974310234ad15eac

SHA512
1fd218dc22ccf1005c848fda7ef43dd280e6eb9e2f14ccc4e1aea7f18eb24bfb4362f59c9c8b079fb056b5682d64b4026b6d5f1701076de49761da087be41ef1

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f6317e40f3b867dfded5686a84b4f483

SHA1
6ac64af04306525d8efe0b93e5d8b6e880c3cc3a

SHA256
ee872f4519a2e571b3cb37dc5298c853a94106d213b2fcb667b7482668ff8e77

SHA512
11ed3734b2634375c566e0b33159c4fafaed5b61218461f75793280d332be9a53f9940f5ef42dd7e2a74d7ba676159023ec5b0ead368a44c210274b8f6df4d7f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
7fa7c5651a3c51e745cafa16a4487d18

SHA1
4e9bf7cae3981d030fdc9eb40b6fc281ac6140e4

SHA256
266635593aae97baf05de2daefad1916d76690d90f9ad03f6e353b12a9d42f95

SHA512
06ef7b5e7fff40e34afc931143a0c9c1abe1248da26e8e161c6918a66dfec5a6aef82d8dce475aa02aeb47e0ec310763d34da18ba89dae19cc9a0398ecc76a8e

Download Submit
memory/1288-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1288-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1316-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1316-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1316-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1316-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1316-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2020-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2252-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2252-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2400-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2400-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2568-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2568-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3052-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-54-0x0000000000480000-0x00000000004A3000-memory.dmp

Filesize
140KB

Download
memory/3052-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-46-0x0000000000480000-0x00000000004A3000-memory.dmp

Filesize
140KB

Download
memory/3052-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download