neconyd | 5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe
Size

65KB
MD5

5082b2e5147f1b4d7e65056ee998085a
SHA1

1074978aadba45482646ddb15d015fd50ce8def8
SHA256

5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5
SHA512

efa25bb2b9564fab813c388fe329af9346e2d2dfd5a4681324a2217b6c81c77aa523db59ac53791e242f0c3beb73202f15009db9cb7099e5689611c3c2080be2
SSDEEP

1536:Ud9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hzf:sdseIO+EZEyFjEOFqTiQmRHzf

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2348	omsecor.exe
1300	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2348	4332	5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe	82
PID 4332 wrote to memory of 2348	4332	5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe	82
PID 4332 wrote to memory of 2348	4332	5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe	82
PID 2348 wrote to memory of 1300	2348	omsecor.exe	92
PID 2348 wrote to memory of 1300	2348	omsecor.exe	92
PID 2348 wrote to memory of 1300	2348	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe
"C:\Users\Admin\AppData\Local\Temp\5dec60b483090bd6925b7810da127926db7f827d5b33e64c4acad05f9a18c8c5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
242f6fc8c4344462b25ccc0d7f352510

SHA1
28ac93a33d926e9062179f895adea6c394027cbd

SHA256
8f093eb8d667defebdc2eb81406f7a4e23753ec8a9b6848a5bd0ec814a1912e8

SHA512
fc24ad5c441f3a1edb39acadd96b832af29076fb369c848da557824fff6b9de1ead16e41bc614a20669d5191e107f4cc8e84cf76e7a1efa4663184e7e9d70d88

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
70fbd8e9bf94154b1f09bf474caeb23c

SHA1
8a0ec84f76e8c8f247deaf75a9c9f43ce6be74eb

SHA256
38992db149c51f92fe6f7f4c43c88558100f303a76e016da71cb77a7eb01723b

SHA512
5f135fbd4ee696c20c1b89ccc634084b63e576473ecd668fecd96c0da955db305280c0a061a857bbc775792f0fd13b9d1fe2f2fc5f2b043f4f4525e96402609a

Download Submit
memory/1300-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2348-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2348-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4332-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4332-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download