neconyd | f11d72433512b6bf325419d1c039abe33d779c5e8cc8172b668e2b3aa23c64ff

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe
Size

63KB
MD5

7fccf02504296f7a2517532adae450fd
SHA1

3725b65262871db393147079430bcde824da2a2d
SHA256

f11d72433512b6bf325419d1c039abe33d779c5e8cc8172b668e2b3aa23c64ff
SHA512

b682d6b7d274daec2031511bfcf552310e9d941b25050580165f9d070fd68566e81418f53566a39277a6d66955973d50293e065faddeb21d826ed57b0b3c9399
SSDEEP

1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1748	omsecor.exe
1028	omsecor.exe
2944	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe
2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe
1748	omsecor.exe
1748	omsecor.exe
1028	omsecor.exe
1028	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1748	2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe	30
PID 2772 wrote to memory of 1748	2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe	30
PID 2772 wrote to memory of 1748	2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe	30
PID 2772 wrote to memory of 1748	2772	JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe	30
PID 1748 wrote to memory of 1028	1748	omsecor.exe	32
PID 1748 wrote to memory of 1028	1748	omsecor.exe	32
PID 1748 wrote to memory of 1028	1748	omsecor.exe	32
PID 1748 wrote to memory of 1028	1748	omsecor.exe	32
PID 1028 wrote to memory of 2944	1028	omsecor.exe	33
PID 1028 wrote to memory of 2944	1028	omsecor.exe	33
PID 1028 wrote to memory of 2944	1028	omsecor.exe	33
PID 1028 wrote to memory of 2944	1028	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7fccf02504296f7a2517532adae450fd.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
63KB

MD5
4af7b3034c24a3e5426ce4d916dba8e7

SHA1
7566e6354d2160f0c56e4008e56032924e235921

SHA256
d923818c66b3b634273058d4b6101da4b8fef0e397138fae308dd91f8f20a7cf

SHA512
269000c92b47d88a9782463bf0e88640039310b9d84320272623c3cf272ad8dcab1ffa957a0852d315f1bfee0cc3c840a544d0dead78c18117ce85aa342b12d7

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
63KB

MD5
4c8ca78b6b7718737a79c4edcef73c53

SHA1
83bd6800e8b88d035f0b8d3515abd56e9b9a9dfe

SHA256
a043db43bc13f7b8e133734c656ba3a8c4116ab7e935335d9d9e9af48f8695ce

SHA512
de9d2cf2e850dbf463049af4b57a720002ee4388dfcb0ab4642cde1715566c5e86f1797376ccb444c9c71f09f5137a11273015b9dadc1f36eeb00717bef792fc

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
63KB

MD5
6cb4a14f77d058c66cf657c498564edc

SHA1
b57aba7bbf3d7322ffa10456e86206bc7324986a

SHA256
e5e0c082201d69f6ffb33a9803940e68344657022ddea06195828c33f529829a

SHA512
8179f47f0eafec1437aa6d79e6585df461bbbe3cce78ddb2c9a927cfe780ae7d270850d01c32efe5064e3152dd4d7a3d639d5f7cb6947f57d4dd128f4b8f3ad6

Download Submit