neconyd | a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Size

72KB
MD5

e544c386c4f1310d215d4bdf5497b1ad
SHA1

d2ad21ac86c9b60fa0ee6d96a2820d3692a3ee7b
SHA256

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60
SHA512

5d49df0218e29afa78886ab460af24db9797168fc80f6a3050c4bd2bddb9998006ca108de8afe33cd324c7e84a7a3f9b269abeeb634f6db347fb76a228a2be74
SSDEEP

1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/52119:+dseIOMEZEyFjEOFqTiQm5l/52119

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
228	omsecor.exe
2724	omsecor.exe
404	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 228	1200	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	84
PID 1200 wrote to memory of 228	1200	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	84
PID 1200 wrote to memory of 228	1200	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	84
PID 228 wrote to memory of 2724	228	omsecor.exe	94
PID 228 wrote to memory of 2724	228	omsecor.exe	94
PID 228 wrote to memory of 2724	228	omsecor.exe	94
PID 2724 wrote to memory of 404	2724	omsecor.exe	95
PID 2724 wrote to memory of 404	2724	omsecor.exe	95
PID 2724 wrote to memory of 404	2724	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
"C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
1060b365b8aeec1aa2b3f622a478d818

SHA1
b3115278c050edb1b08076cbacf7e259001f667a

SHA256
3b781feaa7c21e95453e432b6cfe76a6fe0c62a894ce937bbad840504647fff6

SHA512
8b612d65c24a412877c65321f0378bc50bfb5610f96114cb1839a875cbb4fae0752cc4fc4ca7489c79ac2c428dcc3458e7a6f73e0d5db84509158701a6a87fc9

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
151cc6396cd1e9804e433749f3bb9e30

SHA1
0262179e7a91dd01329d2f03556d2cd027ad8f71

SHA256
f22b25b59855695f9c9d7145909343efa55701807613e73309cf2bac47733dc2

SHA512
ca6c5d0f4b99e01e91ef6b9c2c882f0f8446f0841d8c62d227e5da1978ef58582d5a632f22eb5f2514148090e0f7c70868eaa69ba52e92e67c7983f52dc5a71a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
f1362b6b95aa8654fc33403ec460ba0d

SHA1
d05e4d2302af331219b7fa8b2d0888404e0b9181

SHA256
856baae690a9d8f57f0a523240a7df7824cb8eed07847e3b5091665f628e2fe4

SHA512
bf28d8523f8e4614b4ece22e2999d1f4b84583feb821e3c9e1ade6f2195aab7e7bb3d1b56f4e14ea8540a8162f8a5ccaa1fd1a5e420275db090d77a326bef7df

Download Submit