neconyd | a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Size

72KB
MD5

e544c386c4f1310d215d4bdf5497b1ad
SHA1

d2ad21ac86c9b60fa0ee6d96a2820d3692a3ee7b
SHA256

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60
SHA512

5d49df0218e29afa78886ab460af24db9797168fc80f6a3050c4bd2bddb9998006ca108de8afe33cd324c7e84a7a3f9b269abeeb634f6db347fb76a228a2be74
SSDEEP

1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/52119:+dseIOMEZEyFjEOFqTiQm5l/52119

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3116	omsecor.exe
1952	omsecor.exe
668	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3116	4192	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	83
PID 4192 wrote to memory of 3116	4192	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	83
PID 4192 wrote to memory of 3116	4192	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	83
PID 3116 wrote to memory of 1952	3116	omsecor.exe	100
PID 3116 wrote to memory of 1952	3116	omsecor.exe	100
PID 3116 wrote to memory of 1952	3116	omsecor.exe	100
PID 1952 wrote to memory of 668	1952	omsecor.exe	101
PID 1952 wrote to memory of 668	1952	omsecor.exe	101
PID 1952 wrote to memory of 668	1952	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
"C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
f16a91cd85da9fe28876129b6b703d45

SHA1
eba1f34e023a6b9191916dbc3d0708633f68e931

SHA256
f212fe6ee8287b85896e94f2da15c02939fa47b19a73423e29297066270d970f

SHA512
119fa52b181c6facb9114ce51017cb5b2d0b49322399bb8805900b454430ecc328e5076c22d0dbec12e89733e599ee35707642e00f5abc7ce4991aa191482992

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
151cc6396cd1e9804e433749f3bb9e30

SHA1
0262179e7a91dd01329d2f03556d2cd027ad8f71

SHA256
f22b25b59855695f9c9d7145909343efa55701807613e73309cf2bac47733dc2

SHA512
ca6c5d0f4b99e01e91ef6b9c2c882f0f8446f0841d8c62d227e5da1978ef58582d5a632f22eb5f2514148090e0f7c70868eaa69ba52e92e67c7983f52dc5a71a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
aedecfc84cc72634df74aab5735efb71

SHA1
16234393a126a3d75acffc0533b3b5bcfa2dc900

SHA256
489a98bd696123b2ea08746588bed2f595e9787883f01a5373c40f05fb1e05f9

SHA512
06333b0c08ce9d14b1965e0c7e6e853bd6027d6f90ab446131e357bbc53970b1fc32cd2e36a4a66cdeb78404fefa55238d4372d05cecb5716332961ffc9ee09c

Download Submit