neconyd | fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe
Size

92KB
MD5

8dd4e855465f49a4ae7d98fbc238697b
SHA1

eb2b09e71c5a46cc7114f2d21d1ee38d4d472186
SHA256

fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf
SHA512

76e5ca371ee47db26427334025348dce7049b301552077bd0f23256161d047985141cba971f1440ac30f031fba981a3fc259e25f202c1c8bcb0e810de8bad2ea
SSDEEP

1536:Kd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5d:KdseIOyEZEyFjEOFqTiQm5l/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3104	omsecor.exe
4880	omsecor.exe
2060	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3104	4580	fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe	83
PID 4580 wrote to memory of 3104	4580	fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe	83
PID 4580 wrote to memory of 3104	4580	fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe	83
PID 3104 wrote to memory of 4880	3104	omsecor.exe	100
PID 3104 wrote to memory of 4880	3104	omsecor.exe	100
PID 3104 wrote to memory of 4880	3104	omsecor.exe	100
PID 4880 wrote to memory of 2060	4880	omsecor.exe	101
PID 4880 wrote to memory of 2060	4880	omsecor.exe	101
PID 4880 wrote to memory of 2060	4880	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe
"C:\Users\Admin\AppData\Local\Temp\fc511801d971a1a5af8305d98ebfeab294724a3ec219a3104940c17492e9c4cf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
81aa3aea196df9f07e7980fdacacba7a

SHA1
f53aac38a8087569dd2a386ef5d5fa7087a17c09

SHA256
3b5f68505942e88a316cfcf1dadcc253b4011b17a2d3cd6d7b12ac9fb082af46

SHA512
fe08c617ccf8e8de4e722df4b7f6c9274e401a6048ae25049b01d347e6083b8dacc2df2c3be57f7c8e63f18a4893384aefc0e8af46a936a9ec1d40bfa14375ad

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
b40b890e60357bdb7e22ab3d85c42ec1

SHA1
d2985447a8695539b1f11c925eece7f201012c52

SHA256
c172b933622115fcc497917a4cf8e9751c1da7f3bfad246c011ccb29bff7d615

SHA512
4542df1b9a2232a5492516737d5b71128b00f85d98fe7d6ecf8d6f1d4022c38eb04a8ab0958ac2bc735cced44acc7ea55f60c33da2cbf3feea1b5819247d7771

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
92KB

MD5
d11cf523acf3260d4db2e7347c47a7e6

SHA1
cf747015901225e95226ac5e8c80c869a37e2095

SHA256
2956d117817be4368ce0c62177dfe2bae6f445e6be797b00c3e6f100b5c43347

SHA512
d4c507d217164ced3f8664cb14684a731ad025d99e98d4aa2113cab45d44f2b7e3e02500864c2889974cc3b8377738583f3caa8365713e6688ab8303aa4df4a0

Download Submit
memory/2060-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2060-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3104-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3104-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3104-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4580-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4580-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4880-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4880-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download