neconyd | c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e

Analysis

max time kernel
149s
max time network
129s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
Size

134KB
MD5

0d00526946b84d34a807a350500ce952
SHA1

6142c3bedab608c18b2b35572541a1047a63abe0
SHA256

c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e
SHA512

8aaa25fbe22a86b589495be5ffedb93640e326e587ebd0c1bd6f066d0ade720306ccde6373bd0ec813990c92cf5ef7f87c809bd749222198f0f1db3eef9cb3f1
SSDEEP

1536:bDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi9:XiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2324	omsecor.exe
784	omsecor.exe
2292	omsecor.exe
2052	omsecor.exe
1360	omsecor.exe
1576	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
2324	omsecor.exe
784	omsecor.exe
784	omsecor.exe
2052	omsecor.exe
2052	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2324 set thread context of 784	2324	omsecor.exe	32
PID 2292 set thread context of 2052	2292	omsecor.exe	36
PID 1360 set thread context of 1576	1360	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2152 wrote to memory of 2332	2152	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	30
PID 2332 wrote to memory of 2324	2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	31
PID 2332 wrote to memory of 2324	2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	31
PID 2332 wrote to memory of 2324	2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	31
PID 2332 wrote to memory of 2324	2332	c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe	31
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 2324 wrote to memory of 784	2324	omsecor.exe	32
PID 784 wrote to memory of 2292	784	omsecor.exe	35
PID 784 wrote to memory of 2292	784	omsecor.exe	35
PID 784 wrote to memory of 2292	784	omsecor.exe	35
PID 784 wrote to memory of 2292	784	omsecor.exe	35
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2292 wrote to memory of 2052	2292	omsecor.exe	36
PID 2052 wrote to memory of 1360	2052	omsecor.exe	37
PID 2052 wrote to memory of 1360	2052	omsecor.exe	37
PID 2052 wrote to memory of 1360	2052	omsecor.exe	37
PID 2052 wrote to memory of 1360	2052	omsecor.exe	37
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38
PID 1360 wrote to memory of 1576	1360	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
"C:\Users\Admin\AppData\Local\Temp\c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
  C:\Users\Admin\AppData\Local\Temp\c01b7fba0c779535f8f189195715fbc8f559a81844c572f5c3f01d6062b79c0e.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
26b123b35375434cc474e9100c138a89

SHA1
189a1aca36bba7fbc4e48bcf7d3e35b191c8a145

SHA256
edea49cf3448b574be8d41bf09ef83568ff121705964ab3ed68e943b1b4d3c29

SHA512
e6fef0ed5d39e11c26cd0f95300b2da6795bcaca32335b6ca2107096c741877b90fbd43aac652f67530bff1d78099600e6caf1695e2baedd4315ea7f4ebbac05

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
dfe473762917601f957bfdcaa085664e

SHA1
f651c1986021366864c92414b1b2d464e985f74f

SHA256
c18ad606795a106fe4b4b8671da4e5c75b0917b01fccbd8c829bd98284e8bc4a

SHA512
0f67762efb0d9376809f63b4c04884c152ad03fb38619fcf5919ef35fb4d6af2993670f4a0ffc1b037f2fa482eff6ea66d0fd9d3c537c9726ac5a217b0b8ed8f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
853fc5afbe9d543c7592c702d3fcb1ae

SHA1
737932ae17aff7a4ed02e09f626de90d1da4f09e

SHA256
b6c0b17ef7b9c91cfa74715dd246d37ac914803272fb519580d7900dd054d787

SHA512
01e2f8dabd3357268c57ed320929c9d94ac540744f1b02cf3fd35bb317fe0c357a3c073aa63be2acdf8b46dc05c48f2986900b1df51c8c677ae2c560d54c9549

Download Submit
memory/784-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-45-0x0000000000290000-0x00000000002B4000-memory.dmp

Filesize
144KB

Download
memory/784-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1360-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1360-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1576-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2052-68-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2152-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2152-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2292-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2292-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2324-28-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2324-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2332-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2332-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download