neconyd | 60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe
Size

80KB
MD5

4d3cc41faa31eb96295e76864a47ea99
SHA1

d6fb975c6b1dad0bb857203bf41475bbc5a873f5
SHA256

60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c
SHA512

6757cf1be1dc65c7b876bad17cefb8b9ace5340249df9448a8ec331f11bda36447da7a36b3bb9831e06bd9f93da81af4af7e62a8307fc6ab2a1269fb29ad2984
SSDEEP

1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzJ:3dseIOMEZEyFjEOFqTiQmOl/5xPvwV

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1432	omsecor.exe
4404	omsecor.exe
4256	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1432	1540	60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe	83
PID 1540 wrote to memory of 1432	1540	60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe	83
PID 1540 wrote to memory of 1432	1540	60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe	83
PID 1432 wrote to memory of 4404	1432	omsecor.exe	101
PID 1432 wrote to memory of 4404	1432	omsecor.exe	101
PID 1432 wrote to memory of 4404	1432	omsecor.exe	101
PID 4404 wrote to memory of 4256	4404	omsecor.exe	102
PID 4404 wrote to memory of 4256	4404	omsecor.exe	102
PID 4404 wrote to memory of 4256	4404	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe
"C:\Users\Admin\AppData\Local\Temp\60d125e2ac4160043e06d89dee51a2038d6935e216aa598d91c6599ef605893c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
a1c8fa0c7dfe269da0323f6606f023c0

SHA1
a350ccb4d7d4b40b95d32e28640972c2a6701e89

SHA256
e17318d7c4ed09b55e8a1d07dc9b4d92b4afad168abb79f358148c924bb6d644

SHA512
4aede8fa34c4c77962104c36d254841f50805692a249b81857429db5ff705ac627da191f91c1455570777f6e80bf447f946ce185e2cb622691471528677f4468

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
5b0978f5c2fe1253a95af92680bbb4f4

SHA1
033d632a43734bdea234c9dd2819f07d6cb91a6a

SHA256
8d35f64d7f4e23eb47d46ae05a7db76e6769e6cd7cf7f4c4f50911b0805155a6

SHA512
d795b234f3819e45db18c1642b48dfa256478aad7eef7b119b728d7a0a49cc71adf1d761c37a86caf00599e686e8776ce9c3da888f74940b3940b9f980c439d1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
caf5d39ca70a89a326bd9e3e25c7a55a

SHA1
1c333dcd0acf9dbe4d1e3a2666c6763b1720e1f5

SHA256
17e18760ff5b4f3f4764285bbd21c264a786ccfc829fdcdb20313b87f39216c7

SHA512
2b234cc3cfdd26c2c1c55cc0172c7df7c27949d167285105e42e529f6238622836bb3769b100ecd0fb135fa1c4079b1d0ff506b3ac436ca41399b2bb47aa0d55

Download Submit