neconyd | 012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
Size

96KB
MD5

cc333373eb0d0b42df1beb07df2b8695
SHA1

26bd3c3703f6e804f52741ec931c231f18d9dab6
SHA256

012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870
SHA512

cf3fc2074274d6f170f68b2ae6c8a75e77a0d3453f155229e13629aa7a38a0e6f0066e83327d63a1ccb28acbdb7fe6d22e21fd3f510bdb083274ebf17f6afdd8
SSDEEP

1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:tGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2720	omsecor.exe
2192	omsecor.exe
1308	omsecor.exe
1032	omsecor.exe
1484	omsecor.exe
2108	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
2720	omsecor.exe
2192	omsecor.exe
2192	omsecor.exe
1032	omsecor.exe
1032	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2720 set thread context of 2192	2720	omsecor.exe	32
PID 1308 set thread context of 1032	1308	omsecor.exe	36
PID 1484 set thread context of 2108	1484	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2244 wrote to memory of 2628	2244	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	30
PID 2628 wrote to memory of 2720	2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	31
PID 2628 wrote to memory of 2720	2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	31
PID 2628 wrote to memory of 2720	2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	31
PID 2628 wrote to memory of 2720	2628	012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe	31
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2720 wrote to memory of 2192	2720	omsecor.exe	32
PID 2192 wrote to memory of 1308	2192	omsecor.exe	35
PID 2192 wrote to memory of 1308	2192	omsecor.exe	35
PID 2192 wrote to memory of 1308	2192	omsecor.exe	35
PID 2192 wrote to memory of 1308	2192	omsecor.exe	35
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1308 wrote to memory of 1032	1308	omsecor.exe	36
PID 1032 wrote to memory of 1484	1032	omsecor.exe	37
PID 1032 wrote to memory of 1484	1032	omsecor.exe	37
PID 1032 wrote to memory of 1484	1032	omsecor.exe	37
PID 1032 wrote to memory of 1484	1032	omsecor.exe	37
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38
PID 1484 wrote to memory of 2108	1484	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
"C:\Users\Admin\AppData\Local\Temp\012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
  C:\Users\Admin\AppData\Local\Temp\012e87fea0541eeaab6620cd992bf3be1a86639f383eaf2a2be5f51cc2840870.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
0ccc11868913d7305bac0c611568599d

SHA1
219c20d8207ea9b1d9c0017feed245b20055f0e5

SHA256
45c572298b687ad4d61369d7c821ffe3f3aa3c1137863578daabe838704e1997

SHA512
8799c1dfe300bab7ed9cf2896219a7a6a705153c0e407bf1c72c0f2f65d5a1c2a194bfc563102400028a96ff0d0ea486a43d65c908cae0ad55c2aaad36a1337e

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
240e7501ded0e1bb7a1e4767736d9c8c

SHA1
913bcb148ab2cf13897159c7560094a714f20913

SHA256
a1d65f1fc3e26179a632630923312f16713fdbc1118e36157d76c575af4a5f72

SHA512
867782513c4bfb50218c1965a0fd6a1a9068bf5bf5423dd3e8c9cf9197b8be3cff7e1ad03e3044f1470ad3bb8f1c24f7acc77f8b9314804c621ef8868d222cbc

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
cae55f9d2c90bf9d2e0270a6874bea41

SHA1
d2b14fcfc1dfa62d636f3c25c2a25646b9edafc7

SHA256
d07e5bb5c944e418da4d6d155166bfb1458de3d26b4d611349f63da83e954746

SHA512
b99151dfd71e9eaa1cfcd646b125955685fb5ecf8204e341ad059bea76d157688a87db1566f7432dc03dfb0d3b4f8575baef719925880571d730b1704551c9da

Download Submit
memory/1308-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1308-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1484-85-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1484-77-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2108-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2108-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2244-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2244-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2628-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2628-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2628-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2628-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2720-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2720-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download