neconyd | e7ae92ec9bc2a6170f53debaff1937f505f1a40257db2b0ac1647bda1c7d714d

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
Size

64KB
MD5

65aafeb55cb879323ccace0412735ff7
SHA1

5795cfce2dd294d0f52503dce45520975f37391c
SHA256

e7ae92ec9bc2a6170f53debaff1937f505f1a40257db2b0ac1647bda1c7d714d
SHA512

8749fde3521b762a396cf6522a9b1a154a97c8a05a0eb9da693161dcddec38c7dad9f90b3c075c70e75535a3cf2121db5f5283350f447e43107347edd7c2bc2e
SSDEEP

1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:vdseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3040	omsecor.exe
2972	omsecor.exe
1568	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
3040	omsecor.exe
3040	omsecor.exe
2972	omsecor.exe
2972	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3040	1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	28
PID 1344 wrote to memory of 3040	1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	28
PID 1344 wrote to memory of 3040	1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	28
PID 1344 wrote to memory of 3040	1344	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	28
PID 3040 wrote to memory of 2972	3040	omsecor.exe	32
PID 3040 wrote to memory of 2972	3040	omsecor.exe	32
PID 3040 wrote to memory of 2972	3040	omsecor.exe	32
PID 3040 wrote to memory of 2972	3040	omsecor.exe	32
PID 2972 wrote to memory of 1568	2972	omsecor.exe	33
PID 2972 wrote to memory of 1568	2972	omsecor.exe	33
PID 2972 wrote to memory of 1568	2972	omsecor.exe	33
PID 2972 wrote to memory of 1568	2972	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
3a7a4129a5083499dbe345e87dae73d0

SHA1
1e15ca279069dab35d60552c1fbb44b24e1e9cc6

SHA256
9b14a0eef7dab942fa6298986dfc55ce599a6dfeb715124d347cab52a7ea0acf

SHA512
c32160f6f5b45fbebecb439be86a1e2f4aa4e8412375ddd33b47dca1fd40d40a0af715847b77523b8ca75c121062327be84c613323ee367086d6053526998438

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
0acb7a6900076932b0ce9ed0a43eb223

SHA1
ec0cf0c2e7e64966e544bc6112d74ea0c80e8387

SHA256
bfc246ac3914a0eee61606021d5cc9d3f90090af0aa8c72ddccdf10413effb72

SHA512
6e909830e0e26fdff12b4dcea818f6dffc781078f640c096cf55c6f00c92e09d7740259d22b63072e9ec3980e595a9b0ca1aca8145974125f37b80d0e5faf2cc

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
e939884a017c2f7c274cd1183efea213

SHA1
8c7943dcb278bd1d932edcf55189d56875cbb2be

SHA256
58b7b12ab995c2fb6baf081b676f9c009f689e8eb4fb35c22be090d7720fd3e4

SHA512
74b92640c90cbb51d55b9aa39e548511b9869eab312ffb8bb12fd4a143be35366bb66b88ecad3816ca33e9020661891b8195ab8392d08798623327afc060f772

Download Submit