neconyd | 4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
Size

89KB
MD5

69c5169baa9780b5e5b62c91577950f6
SHA1

7f9c4ca75619783d4b255b692d5f2c0a70c80ad5
SHA256

4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d
SHA512

5d8a9b219f6e7eb5f88fbf760ffa649184d6d95b46774e922f0154b43502dc4269bb0198847340caf2f11aaacb86faa8b0ab368873c095ac3c3c5b1984b5e900
SSDEEP

768:7MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA/:7bIvYvZEyFKF6N4yS+AQmZTl/53

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3620	omsecor.exe
4396	omsecor.exe
4672	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3620	4496	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	83
PID 4496 wrote to memory of 3620	4496	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	83
PID 4496 wrote to memory of 3620	4496	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	83
PID 3620 wrote to memory of 4396	3620	omsecor.exe	101
PID 3620 wrote to memory of 4396	3620	omsecor.exe	101
PID 3620 wrote to memory of 4396	3620	omsecor.exe	101
PID 4396 wrote to memory of 4672	4396	omsecor.exe	102
PID 4396 wrote to memory of 4672	4396	omsecor.exe	102
PID 4396 wrote to memory of 4672	4396	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
"C:\Users\Admin\AppData\Local\Temp\4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
b473358cab1c69ef5a49dfd28ede9811

SHA1
51a9c3d92ee68d1e09982377e2fe910333942e4f

SHA256
d9f63596b8c3f6b1ef93ca2c73ed685b7279d35c01ecb1db7b5309794028705d

SHA512
5687470d69afe8ac2ae854fff4741b7145454bc1d6dab47f9f70c73429d48fbb610a3948a2732ca62a549837863a32417683a1a2d45f24223ffa3e5327ffa310

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
b541d1c45b1630570bd0a168fb96b126

SHA1
19f88ec04356cc6ffbbac4dfebef78983ed95092

SHA256
924ac86434eb52aef7e7f8316e37e6f41530d000395b434777197e2b78923559

SHA512
48a8ce8a0911bcafbde2f44f2e1a203d14dd62804f5979ce23d951bfb3f1c0100b0f3308de56263ebf2115bcae91311ef3d7863d47b7f440706291de9dcbc008

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
e14a57cbdc4e2ecb46e2f3e8834175b6

SHA1
2781f6867b26fc88b97b3a88bd66c5dc18b76344

SHA256
4d60c2e5a562a311e293ccdbb253312a868311573afc48923b2b193727538c84

SHA512
f85a9b4f3c15b54435b2fa0652767ca220987319304d9ee2dc1a8a3232af9a2a22cab2ca38a54d5888b28d704217e55bc0f8efeb9c4c68382bafa00937fac306

Download Submit