neconyd | 11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe
Size

76KB
MD5

48ad7263b9b37f8977194f9c4bfc6070
SHA1

2357f8d7e4feb8b9396ee09784c2f6acde2d14dc
SHA256

11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42
SHA512

30b748fbff66f5ffb0bc7349202dd1bd1edfee763a5ac1d9455553e5712636e29956a912e3b97ed2f227302f43c60352d8d6d76e7dcac8044d05e6cfa2d6dd59
SSDEEP

1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11V:/dseIOMEZEyFjEOFqaiQm5l/5w11V

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2920	omsecor.exe
2672	omsecor.exe
464	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2920	4852	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe	82
PID 4852 wrote to memory of 2920	4852	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe	82
PID 4852 wrote to memory of 2920	4852	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe	82
PID 2920 wrote to memory of 2672	2920	omsecor.exe	92
PID 2920 wrote to memory of 2672	2920	omsecor.exe	92
PID 2920 wrote to memory of 2672	2920	omsecor.exe	92
PID 2672 wrote to memory of 464	2672	omsecor.exe	93
PID 2672 wrote to memory of 464	2672	omsecor.exe	93
PID 2672 wrote to memory of 464	2672	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe
"C:\Users\Admin\AppData\Local\Temp\11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
ff9931b198a37da07d5cb2f1ac7898f7

SHA1
07ebeaf033a1a2d7742b4c7856f32ab634224a65

SHA256
99912729ddc28ef5f10f6ac05bd3f2146b61fdcdf64f905aee538321f33ccbe4

SHA512
2dc2c2479e4750476d7742529c77781e6fca5520b02ff65e8081992492fb15a2e3c7d70bc0c33fc8dd46f5fb9d7357e1341b68c4fe8b29bd6bf3451b94bb1a96

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
bf31ac27608788248f115eb1f218bf22

SHA1
ca1e30c69b926ff8b25be8220e4bcda08719a302

SHA256
42b749b981c46e1049e08e5b26731ecab689f95d3eb31cb4a2323bc65369eeec

SHA512
a29082302e48aa3020e5603e38aca2c2d5fb0f49443bf70c647dc748f09e918f81e72546b8ff83f727ac96d41ecff715de6f1526137ab1a9b2c9cc7291ba4ca3

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
a9617993a47afc118dd44e9aa05acfe9

SHA1
88685f4aa284c7899a65538a1c5a1f8d99dec77f

SHA256
0eacf211b029ab53aabdc1ffc78fdfd49eef28dfba34ebd10429dfcb5b519b8b

SHA512
0dcce2d3ccbcedfeaaf8ad15ac6654ad2e843de254664db7eb786a26a16462d70f13cde938a13c97f7c49b586f0640f7923ac1e32ae375c251190080b783b4f7

Download Submit
memory/464-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/464-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2920-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2920-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2920-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4852-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4852-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download