neconyd | 03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe
Size

89KB
MD5

61dcf1f43ad6ca9743db5759ca8a0880
SHA1

a6107086850b3b2885a3682acebda7329c4289f7
SHA256

03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24
SHA512

6c1d73723c14092e3879186c4c2d0f2f235033eee9bc039eff70857170cb50e8f14464859a5a28bb2da1d8c4199a577efb35c1adf10f0e5301039b89a8b49dfa
SSDEEP

768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA1:NbIvYvZEyFKF6N4yS+AQmZTl/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1124	omsecor.exe
4036	omsecor.exe
4984	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1124	4828	03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe	83
PID 4828 wrote to memory of 1124	4828	03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe	83
PID 4828 wrote to memory of 1124	4828	03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe	83
PID 1124 wrote to memory of 4036	1124	omsecor.exe	100
PID 1124 wrote to memory of 4036	1124	omsecor.exe	100
PID 1124 wrote to memory of 4036	1124	omsecor.exe	100
PID 4036 wrote to memory of 4984	4036	omsecor.exe	101
PID 4036 wrote to memory of 4984	4036	omsecor.exe	101
PID 4036 wrote to memory of 4984	4036	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe
"C:\Users\Admin\AppData\Local\Temp\03a512e79ab5e13215ffd6314bfec1cffa571fc5501744628c9c6bc823a01b24N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
61408704d82320fa5f8108174c4c843b

SHA1
1fdc6bb7935ebd1815d8f3f5380e0aaf34cff720

SHA256
05220496e903b6e42dd95f55a6513b0429cd50f310ca02af7dccb7696001e4a0

SHA512
24fff0ab4438e4fe4c1166c1bf86f7a984c20a4a2a8f335f0ce99b77ed1e046b134a86ce94b8bf4fc8229c55eaa9782ee3877e648651026c6929651f7f49972e

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
dbea0c4a023cfcf5b9d366c049a824f2

SHA1
f2b0a0fb7d0f6deb8b896a4e05a050afd0d34cb6

SHA256
339ddf44b59e237b5641d9a1f47efd2caf85474e4fbc60693e460b9b9fefbf86

SHA512
f083f0164bb098c0ef70c7f2946cdc7a0872ffd3fe6a2267bee6968cf0479d90eee594d9fbe2278c65cb302ffe793c82bd0f6a5e679dd4b496b3cfb91e83915d

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
d8fa7b10cfb1f0091dacba29d4049919

SHA1
c21461d47fda0091e301e2bb084130bdec9a0688

SHA256
1d115d104f7fdc56d4904afdc121536b659fadd83ce40ec8cdf011d324cf9ab9

SHA512
5b9dab9b36482ad7f6e3c105ae5691f41ed48bb516e789ab944f84e126936c7c46bcefef26f23a35f87b6705e3b92026317d28dd059861d3c7193785d8f38f5a

Download Submit