neconyd | a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Size

96KB
MD5

891320169ee28e07d8599c634ed47b63
SHA1

9165a1f25596e23bae9922cc8c58d2785b72d210
SHA256

a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72
SHA512

a69c1e3e92293d1e2e457179b8396a4c41c8ff3ee3827bef444486756c2c39000de37d719cf38c13fa29109990514ebb50ae03e8f1cdadcef55cc1ddd058da4c
SSDEEP

1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:SGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2880	omsecor.exe
3032	omsecor.exe
3052	omsecor.exe
696	omsecor.exe
1872	omsecor.exe
2428	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
2880	omsecor.exe
3032	omsecor.exe
3032	omsecor.exe
696	omsecor.exe
696	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2880 set thread context of 3032	2880	omsecor.exe	32
PID 3052 set thread context of 696	3052	omsecor.exe	35
PID 1872 set thread context of 2428	1872	omsecor.exe	37

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 2524 wrote to memory of 804	2524	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	30
PID 804 wrote to memory of 2880	804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	31
PID 804 wrote to memory of 2880	804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	31
PID 804 wrote to memory of 2880	804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	31
PID 804 wrote to memory of 2880	804	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	31
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 2880 wrote to memory of 3032	2880	omsecor.exe	32
PID 3032 wrote to memory of 3052	3032	omsecor.exe	34
PID 3032 wrote to memory of 3052	3032	omsecor.exe	34
PID 3032 wrote to memory of 3052	3032	omsecor.exe	34
PID 3032 wrote to memory of 3052	3032	omsecor.exe	34
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 3052 wrote to memory of 696	3052	omsecor.exe	35
PID 696 wrote to memory of 1872	696	omsecor.exe	36
PID 696 wrote to memory of 1872	696	omsecor.exe	36
PID 696 wrote to memory of 1872	696	omsecor.exe	36
PID 696 wrote to memory of 1872	696	omsecor.exe	36
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37
PID 1872 wrote to memory of 2428	1872	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
"C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
  C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3052
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b44161889282969e58cb371095ecf9e7

SHA1
34422a005d47b8cd573b8b969f4e255c5f453d81

SHA256
873ed0d863e418a32de0231187d39d5e55c63520792195b69126798f9d75a032

SHA512
0c3c0c14b1b27a6cb0d9ef84551cb0302cc7440aa78535fff741c86895565fcf20585ef925657b55b258c83af767c540d6a3ce741a0f38d7027425bb3ffb01c3

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5284a35b942be64f319c9c41724ae49d

SHA1
f9afd1491aa27c44a8520b5277b22c0d9f17ce01

SHA256
27863b1a2edf1d02c072e82edd392175752d7efe332c5494266498144b8426c9

SHA512
a463613e30b83feb277ace5d92f6878ccb59402dc8af117ed27a46e61d4478aed2cb0abc0a57a6c280320f51cdf3abd4c3da8ec87b2fc114f197df288605c034

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
cdbda2429ed41d3587873d6c137eee77

SHA1
5c85e9ffa765bd7ab539ec1a3fae17216b381e7f

SHA256
472cf72e410d0bd6be77d96d329ade7fb1c1b00443363f7aac3f607bc962cfb9

SHA512
afdc97231d737530f4fc46c109e8d77f684d6e3e7e169982c107af3d46e3b4cb9b79d5c3091dfbb9afe8fa0726b9dff0e5a4df73eb4467852d0d57c23b2b1393

Download Submit
memory/696-73-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/696-80-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/696-91-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/804-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/804-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/804-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/804-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/804-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1872-90-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2428-95-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2428-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2524-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2524-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2524-35-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2524-10-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2880-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2880-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3032-54-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/3032-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3052-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download