neconyd | 6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
Size

88KB
MD5

4653f45619e769536486e5fe5d4eb5b5
SHA1

6a85b37d118bb869a56251021a2d19b1c38e57b5
SHA256

6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158
SHA512

5b990d00d09de08a1ded568bd708702a05cf667fb77891ef6633f44f0f3af0b4cf562ddb6c402c9025964b1d89d2f636465cae6becf7ba1df3f262ff8b751fdb
SSDEEP

1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5Z:bdseIOMEZEyFjEOFqTiQm5l/5Z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4320	omsecor.exe
904	omsecor.exe
3544	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4320	1272	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	82
PID 1272 wrote to memory of 4320	1272	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	82
PID 1272 wrote to memory of 4320	1272	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	82
PID 4320 wrote to memory of 904	4320	omsecor.exe	92
PID 4320 wrote to memory of 904	4320	omsecor.exe	92
PID 4320 wrote to memory of 904	4320	omsecor.exe	92
PID 904 wrote to memory of 3544	904	omsecor.exe	93
PID 904 wrote to memory of 3544	904	omsecor.exe	93
PID 904 wrote to memory of 3544	904	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
"C:\Users\Admin\AppData\Local\Temp\6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
91722738f9c979d87eee773b3c52231b

SHA1
363b3318c8e22217096e8073d588b4dae1308c15

SHA256
de6c4fcc8c22c1dd13662573cbe398a50a237a9c0751f93d3092f06ce222a50d

SHA512
85bf63460e066dbd9604901d0bd5d60042548c606e36e128b4add6098e4861481bf241b22b32c949be8ef00aac1138ad88403febd647f85e0b0e97c101bf52f1

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
1dc078ba12d431de5fcb0c940326bd4d

SHA1
cad4602e023d59f3dd3e4c6555a37290612f169e

SHA256
547e440f213cca6496b5b68fe109e45455a242443a6d3fac5c6949550344ff08

SHA512
e7a91660829ba746e057ce7905968ae9f794855f35fb720424f33a281728b3879b70691d08469f32725337368aa8952d139fb9b71ecb87cf47df21c1a1badae2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
b189fed241be049d4f8666c6520aa367

SHA1
3a90db9f3e5e927f825fcd10c208c7168b187346

SHA256
aed8df633770c38dfeaa25d99903879e0026c14257b45440656344ea1b8673ad

SHA512
f0c40b755822b6a9fb2f6b26b4ced075cf295c4535f5b180ee128a95054e817f3e3ead4f6665d6db858e6d5abb1141a7c4761fa7afea69766ca2cc74f7456f79

Download Submit