neconyd | 015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2025, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe
Size

92KB
MD5

2be30265d272f74f1aca2612f0684f54
SHA1

a36210ff240468e9f2cc25a5848689629c917e83
SHA256

015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033
SHA512

645594d199256ebc93cd344a915d29b2fef503abe3ca2e8acedb7386a14b08ff4cc44dd4c0dc25c4de5867e742c8b935ea2ce76b6b4808873958c639ef40a2d7
SSDEEP

1536:Xd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5d:fdseIOyEZEyFjEOFqTiQm5l/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3584	omsecor.exe
3824	omsecor.exe
1688	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3584	2992	015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe	83
PID 2992 wrote to memory of 3584	2992	015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe	83
PID 2992 wrote to memory of 3584	2992	015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe	83
PID 3584 wrote to memory of 3824	3584	omsecor.exe	100
PID 3584 wrote to memory of 3824	3584	omsecor.exe	100
PID 3584 wrote to memory of 3824	3584	omsecor.exe	100
PID 3824 wrote to memory of 1688	3824	omsecor.exe	101
PID 3824 wrote to memory of 1688	3824	omsecor.exe	101
PID 3824 wrote to memory of 1688	3824	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe
"C:\Users\Admin\AppData\Local\Temp\015eb74a40ed673508cbb498237fa63e48b4940fc6c32d3d5e5dd4598b2fc033.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
9b8db053b2718057c3ccd3fc3218a580

SHA1
3e4665c0f2df2a05f6457fc6905fd62e122d7386

SHA256
99851bc4fcfd6ac96c4bdb54a808444e6c75a177317228692f61d514c0350b3e

SHA512
8a900e80db4fe4d5f0c821a2b2979635cbabc1f5b618f12dce6f60196c49a94f04e92da85323add2394f4c9d80462ee9d845068363fde11a8b0e15925474919f

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
ba65bb96fddb219e2d3a4c102a0004af

SHA1
c472ba2226537accd3e2f18d05204216dc4d7db1

SHA256
eeb135b02a840d285641fe3bfa1f188c1e7c11d8d75c3b0516e52587a45bf13e

SHA512
a5764c6ae9ad2fad0b7afb5e58a16fd3f7cba73dfea53428a54ee86e413f1bd1a64a9d05a090f1e12c9aeb772a3af707966c0419f42c9caf7aedd92a1f73b9a1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
92KB

MD5
d8914f102c2ec1e373615bbb573dd2ec

SHA1
2c3d652d39f9c366d02440c85c05e3671eabe7cd

SHA256
32fafe0e89ba76e1c8e2a48148371bb514591f18f74f49bb596065810da98007

SHA512
c4b2d4e586bd9a466d2be790e04c772835b1ddf20f9a89d61e7dbcfcf196798fa279710d300d4a2be177fa143eee8aab9980baccf512d8d5d46dad183de39163

Download Submit
memory/1688-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1688-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2992-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2992-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3584-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3584-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3584-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3824-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3824-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download