neconyd | 4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
Size

65KB
MD5

48bd7132d989b48d0a6b8766d77f4b60
SHA1

c47d9b3d79e7cf24e0ad87342491a089e1e3442c
SHA256

4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4
SHA512

2cbddb5444d2fb3489bc25b3d54b84dc3b7ec2cc3d6ad5cad04356b8c415b2233463048fdc81b2c04c73d449cd0d2e102257093bf4d492c6ec589208827774fe
SSDEEP

1536:/d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:3dseIO+EZEyFjEOFqTiQmRHz

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2676	omsecor.exe
1544	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2676	828	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	83
PID 828 wrote to memory of 2676	828	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	83
PID 828 wrote to memory of 2676	828	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	83
PID 2676 wrote to memory of 1544	2676	omsecor.exe	101
PID 2676 wrote to memory of 1544	2676	omsecor.exe	101
PID 2676 wrote to memory of 1544	2676	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
"C:\Users\Admin\AppData\Local\Temp\4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
44ff4bff68af2dbb15924b8cd2f3fc72

SHA1
384140542557e13729e8ac04702629bf2565ed6e

SHA256
493dda7c81fd3974d60fd710b5f000429ab685ffd132d78b3370d601397f0126

SHA512
d65dbac29a0b14145f138c553dac161c19ba0feb940f1626caf88c8d88fab44d6a2f4219589f7d0585ce0b5ac33a2231235e2da81c61ba4fdb0a22fa73fc9a47

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
9cba65bc4a339d781544f639c9aa15f3

SHA1
3b9271901bbbaf03ade05aedc35787e6817e91cd

SHA256
a85efc36e1eda8269717fe7d44d0476acbd16aad2a1c1bb542d66b6ad465509d

SHA512
42422a581a8710659776f11eb2dfaab15d18024839e9ae63417c9c5bb2d6dc65e6da8d69951a91073eabb6a86329a283b37db2a0b0998f72d56a67722aa28f4a

Download Submit
memory/828-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/828-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1544-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1544-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2676-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2676-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2676-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download