neconyd | a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe
Size 90KB
Sample250108-qkdnfstmdj
SHA256 a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f
MD5 a38465706d079d0ccb6ee3ac3370393f
SHA1 4c6db81007225f615f8c910cdeb959a5c95a6aeb
SHA512 42c70b1eb2174241bf769b4b5acc99a70ef310d4b157e2e54ed512bc8ca80b73d197536bd35c77e64abb261afb819ba1d13c725db88a43991523e389adb75b87
SSDEEP 768:tMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA+:tbIvYvZEyFKF6N4aS5AQmZTl/5W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3124	omsecor.exe
3508	omsecor.exe
2312	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3124	2972	a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe	83
PID 2972 wrote to memory of 3124	2972	a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe	83
PID 2972 wrote to memory of 3124	2972	a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe	83
PID 3124 wrote to memory of 3508	3124	omsecor.exe	101
PID 3124 wrote to memory of 3508	3124	omsecor.exe	101
PID 3124 wrote to memory of 3508	3124	omsecor.exe	101
PID 3508 wrote to memory of 2312	3508	omsecor.exe	102
PID 3508 wrote to memory of 2312	3508	omsecor.exe	102
PID 3508 wrote to memory of 2312	3508	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe
"C:\Users\Admin\AppData\Local\Temp\a94faea1e462e715ca28d2d3265a9cd5be3085dc09847cf0a08ba1c4cc063d8f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 90KB
SHA256 6a825b469f028e1131618052ab2c908f18ae9832bb4d7e79d4e25e1bc48b8a15
MD5 fbedf4f72074ecc204c4ad892be32c08
SHA1 58610ea2bb23f0ad0c561987a84a54acb5b5ccdb
SHA512 9c23a6dbed0767d17c5ac4bef560d6d38ebe5843c8fdf6e9b2c327552849da50a5fd02999364e638749aadbc1dde69f31e6f190c3cb191e679f114a0aaea6b99
SSDEEP 768:NMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA+:NbIvYvZEyFKF6N4aS5AQmZTl/5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 90KB
SHA256 abc77c4d6c6d87348ef5de6e04449d13d48f1f77bb8b737f8ac4d73a50c416ac
MD5 8c60b488dfbc5baeb6def2e229c6c752
SHA1 829563f186b5bb81341eeb955ae93f1fa681dd29
SHA512 e692b6941223e7edffac942bf54965c86e41222121035407155b5f1cf0910d983a40c29d3c4e8091dbf802985d0017b7e9a5bb5205cd9af55ed453b6d8087df9
SSDEEP 768:EMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA+:EbIvYvZEyFKF6N4aS5AQmZTl/5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 90KB
SHA256 e33047fee996b31504da21b5eff9a5633b404c838c97ce3ca8681b0ae9256ae2
MD5 c8ccba422d50fe1e8b47e8118d6b260c
SHA1 97a8865f362c085ebe8cc32410c2d5ee3279af79
SHA512 82e70bf3fa92bfc5d9c1215e9118bc52f25cb94ae1b86e5c4e6b44f7123da4164a583ad616958fe08fddfbab8e221208dfd62b1cd5c8ad084caade82b9fc7a5b
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA+:BbIvYvZEyFKF6N4aS5AQmZTl/5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2312-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2312-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2972-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2972-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3124-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3124-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3124-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3508-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3508-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads