neconyd | a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Size

96KB
MD5

891320169ee28e07d8599c634ed47b63
SHA1

9165a1f25596e23bae9922cc8c58d2785b72d210
SHA256

a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72
SHA512

a69c1e3e92293d1e2e457179b8396a4c41c8ff3ee3827bef444486756c2c39000de37d719cf38c13fa29109990514ebb50ae03e8f1cdadcef55cc1ddd058da4c
SSDEEP

1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:SGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1360	omsecor.exe
4456	omsecor.exe
3148	omsecor.exe
1340	omsecor.exe
2128	omsecor.exe
4012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1156 set thread context of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1360 set thread context of 4456	1360	omsecor.exe	87
PID 3148 set thread context of 1340	3148	omsecor.exe	108
PID 2128 set thread context of 4012	2128	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4372	1156	WerFault.exe	82
2128	1360	WerFault.exe	85
3492	3148	WerFault.exe	107
3284	2128	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1156 wrote to memory of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1156 wrote to memory of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1156 wrote to memory of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1156 wrote to memory of 1168	1156	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	83
PID 1168 wrote to memory of 1360	1168	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	85
PID 1168 wrote to memory of 1360	1168	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	85
PID 1168 wrote to memory of 1360	1168	a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe	85
PID 1360 wrote to memory of 4456	1360	omsecor.exe	87
PID 1360 wrote to memory of 4456	1360	omsecor.exe	87
PID 1360 wrote to memory of 4456	1360	omsecor.exe	87
PID 1360 wrote to memory of 4456	1360	omsecor.exe	87
PID 1360 wrote to memory of 4456	1360	omsecor.exe	87
PID 4456 wrote to memory of 3148	4456	omsecor.exe	107
PID 4456 wrote to memory of 3148	4456	omsecor.exe	107
PID 4456 wrote to memory of 3148	4456	omsecor.exe	107
PID 3148 wrote to memory of 1340	3148	omsecor.exe	108
PID 3148 wrote to memory of 1340	3148	omsecor.exe	108
PID 3148 wrote to memory of 1340	3148	omsecor.exe	108
PID 3148 wrote to memory of 1340	3148	omsecor.exe	108
PID 3148 wrote to memory of 1340	3148	omsecor.exe	108
PID 1340 wrote to memory of 2128	1340	omsecor.exe	110
PID 1340 wrote to memory of 2128	1340	omsecor.exe	110
PID 1340 wrote to memory of 2128	1340	omsecor.exe	110
PID 2128 wrote to memory of 4012	2128	omsecor.exe	112
PID 2128 wrote to memory of 4012	2128	omsecor.exe	112
PID 2128 wrote to memory of 4012	2128	omsecor.exe	112
PID 2128 wrote to memory of 4012	2128	omsecor.exe	112
PID 2128 wrote to memory of 4012	2128	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
"C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
  C:\Users\Admin\AppData\Local\Temp\a6c42b7271311b3b9342592c02b9b63f3761c2c13aa47446941320620c550b72.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 256
        8⤵
        Program crash
        
        PID:3284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 292
        6⤵
        Program crash
        
        PID:3492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 300
      4⤵
      Program crash
      PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 288
  2⤵
  - Program crash
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1156 -ip 1156
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1360 -ip 1360
1⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3148 -ip 3148
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2128 -ip 2128
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
2a852ee289cae5da8bafdc91003e1680

SHA1
1e63d307af16f887a7e60f88764c43a8da6946c5

SHA256
1bb270056843f9c22b47e48fb5fe3b57ee351dab3a4dbf0554130746183d7fae

SHA512
3f796dac8c210cf02c574327eff80b16f0c0e3357047d9f4046feec4a01de85ca945ff9387a40fc6863434da742f95b6d5ffbe142f64053e7d244fe40248c8e2

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b44161889282969e58cb371095ecf9e7

SHA1
34422a005d47b8cd573b8b969f4e255c5f453d81

SHA256
873ed0d863e418a32de0231187d39d5e55c63520792195b69126798f9d75a032

SHA512
0c3c0c14b1b27a6cb0d9ef84551cb0302cc7440aa78535fff741c86895565fcf20585ef925657b55b258c83af767c540d6a3ce741a0f38d7027425bb3ffb01c3

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
d05392e7dbd4c897de3fb908cef4e03b

SHA1
9a70952376618d7a0dfd7e649c2d675f08ba0b27

SHA256
f756f03c1b1da15b3e8f5128cff21cfd83d18a507f1a1f32d6d182735f13618b

SHA512
43a6800b67d41e9164f2f95f3d6f31d1c044a101684d54c3cdb713d14124ac86600f6026b343caad92a450dfb204a54a204272423637ef1751bb4ce993b36868

Download Submit
memory/1156-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1156-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1168-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1168-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1168-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1168-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1360-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1360-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2128-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2128-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3148-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3148-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4012-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4456-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download