neconyd | 19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe
Size

96KB
MD5

b6c11374a70c8c650f8555c2e6a77acc
SHA1

d3c3a0de61b638e44e9372315193b8f342af5914
SHA256

19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096
SHA512

acbe633c216b2e7851af349492c8985c1467bbdfad64183cf62e0dc8f6ff785b221a06d1591b7fdd4d2fc757d2fe43cca61c9a95f9dbd81461ea6f1244b46d81
SSDEEP

1536:DnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:DGs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3168	omsecor.exe
548	omsecor.exe
2204	omsecor.exe
1424	omsecor.exe
2104	omsecor.exe
1888	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 3168 set thread context of 548	3168	omsecor.exe	86
PID 2204 set thread context of 1424	2204	omsecor.exe	100
PID 2104 set thread context of 1888	2104	omsecor.exe	103

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1152	224	WerFault.exe	81
1504	3168	WerFault.exe	84
1312	2204	WerFault.exe	99
2272	2104	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 224 wrote to memory of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 224 wrote to memory of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 224 wrote to memory of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 224 wrote to memory of 1428	224	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	82
PID 1428 wrote to memory of 3168	1428	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	84
PID 1428 wrote to memory of 3168	1428	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	84
PID 1428 wrote to memory of 3168	1428	19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe	84
PID 3168 wrote to memory of 548	3168	omsecor.exe	86
PID 3168 wrote to memory of 548	3168	omsecor.exe	86
PID 3168 wrote to memory of 548	3168	omsecor.exe	86
PID 3168 wrote to memory of 548	3168	omsecor.exe	86
PID 3168 wrote to memory of 548	3168	omsecor.exe	86
PID 548 wrote to memory of 2204	548	omsecor.exe	99
PID 548 wrote to memory of 2204	548	omsecor.exe	99
PID 548 wrote to memory of 2204	548	omsecor.exe	99
PID 2204 wrote to memory of 1424	2204	omsecor.exe	100
PID 2204 wrote to memory of 1424	2204	omsecor.exe	100
PID 2204 wrote to memory of 1424	2204	omsecor.exe	100
PID 2204 wrote to memory of 1424	2204	omsecor.exe	100
PID 2204 wrote to memory of 1424	2204	omsecor.exe	100
PID 1424 wrote to memory of 2104	1424	omsecor.exe	102
PID 1424 wrote to memory of 2104	1424	omsecor.exe	102
PID 1424 wrote to memory of 2104	1424	omsecor.exe	102
PID 2104 wrote to memory of 1888	2104	omsecor.exe	103
PID 2104 wrote to memory of 1888	2104	omsecor.exe	103
PID 2104 wrote to memory of 1888	2104	omsecor.exe	103
PID 2104 wrote to memory of 1888	2104	omsecor.exe	103
PID 2104 wrote to memory of 1888	2104	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe
"C:\Users\Admin\AppData\Local\Temp\19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe
  C:\Users\Admin\AppData\Local\Temp\19109267c40fdffcb60d1b0351989d4db980dac738831fbcffd0a421ad72a096.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 256
        8⤵
        Program crash
        
        PID:2272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 292
        6⤵
        Program crash
        
        PID:1312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 300
      4⤵
      Program crash
      PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 288
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 224 -ip 224
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3168 -ip 3168
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2204 -ip 2204
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2104 -ip 2104
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5f8b98d3d6c6e2eb7d05c1de677f1ce5

SHA1
c531ae595d274a616ae5cc77f06510619f885720

SHA256
6c936cf2190820642c816fca00c55e1cdf8d581df0e047ededa9150440580f88

SHA512
ab64b58c32c3ff8f5168c231a6d62807f10e2d7e14547e86f3e6e7dd141952d72a19a2c23a954b8b90eb480bbbc62b9a6fc363ce74309b5d24021e07bd78d2c4

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
ce26eb1fd17e208d0304cebb0fcdf16c

SHA1
dfb1e9334107fb835e88809f87754bee72f925e6

SHA256
928e1ef4a8ce5d314e1ead10bcb87c8516c78e2054cca08a8f9050cbc87337a3

SHA512
632be355a151413834f13f35ede2de941549e53807b59f0c50450a3bc1a1b15ff36fd76356447e8b3ab9d25d5837a3f837d3a05d1ab80ef021df2152e6f97e83

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
2f497b525eee18d6401976de578e4581

SHA1
0bda3de3113da980d620dc3f57bdfcba97e59133

SHA256
b33b655bcd19aac0d9562bbebc7d363363db0975ef9000f62235f2a480f9b4e1

SHA512
ad885dc359ab6c1bad9fc42756b8d7789e0b21a4c7377f59b06193d313d544f23dfe868959868c39f703a33fdc81e7a388681cf53395e873496be96158848728

Download Submit
memory/224-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/224-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/548-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/548-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1424-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1424-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1424-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1428-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1428-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1428-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1428-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1888-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1888-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1888-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2104-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2204-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2204-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3168-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3168-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download