neconyd | e7ae92ec9bc2a6170f53debaff1937f505f1a40257db2b0ac1647bda1c7d714d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
Size

64KB
MD5

65aafeb55cb879323ccace0412735ff7
SHA1

5795cfce2dd294d0f52503dce45520975f37391c
SHA256

e7ae92ec9bc2a6170f53debaff1937f505f1a40257db2b0ac1647bda1c7d714d
SHA512

8749fde3521b762a396cf6522a9b1a154a97c8a05a0eb9da693161dcddec38c7dad9f90b3c075c70e75535a3cf2121db5f5283350f447e43107347edd7c2bc2e
SSDEEP

1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:vdseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1016	omsecor.exe
1876	omsecor.exe
3224	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1016	4924	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	83
PID 4924 wrote to memory of 1016	4924	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	83
PID 4924 wrote to memory of 1016	4924	JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe	83
PID 1016 wrote to memory of 1876	1016	omsecor.exe	99
PID 1016 wrote to memory of 1876	1016	omsecor.exe	99
PID 1016 wrote to memory of 1876	1016	omsecor.exe	99
PID 1876 wrote to memory of 3224	1876	omsecor.exe	100
PID 1876 wrote to memory of 3224	1876	omsecor.exe	100
PID 1876 wrote to memory of 3224	1876	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65aafeb55cb879323ccace0412735ff7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
b2234ee89f4da268acf6c3b3d4b7f797

SHA1
698695a6af3559a1a47531057bc5e35efe991cb6

SHA256
75e1146879545c37c930a90ca7605ef7a807e5a716479b47c81b807b3919db7e

SHA512
7b82621ce2525d608594cd24f5963238b8f76b15d9d3dc2a17a8c350a612cd332dd7e095238d608be6bba29ec4c9ec9a339e51cea55ac203e97f228e0685b199

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
3a7a4129a5083499dbe345e87dae73d0

SHA1
1e15ca279069dab35d60552c1fbb44b24e1e9cc6

SHA256
9b14a0eef7dab942fa6298986dfc55ce599a6dfeb715124d347cab52a7ea0acf

SHA512
c32160f6f5b45fbebecb439be86a1e2f4aa4e8412375ddd33b47dca1fd40d40a0af715847b77523b8ca75c121062327be84c613323ee367086d6053526998438

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
a443c42faccca618fac9a040145e6749

SHA1
d1924749919d2b4f62818c84cc9456fae9ceb85d

SHA256
8b42dce6120dcffeed76b58549265f0b20b812f74238690f73e181ea7abb0e01

SHA512
3a6f30af9851b85f5bdb031ae78ac5019cafa0aac3242869658918ee9953ea9b9ea80cf9e16f54972b82cddb41f49c44d49cc2fe09f4569b8dd097c75a8bfc36

Download Submit