neconyd | 1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82

Resubmissions

12-01-2025 08:55

250112-kvltxsxqdj 10

12-01-2025 08:52

250112-ks6fjsxpgn 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe
Size

72KB
MD5

62722158cbc7ab4682bce34d39c83a60
SHA1

223c262a2527b205b3f79fb733c2d5f743f5ffab
SHA256

1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82
SHA512

942b309da503f6b1173ce74f1a82dd17009d56bb9f776622c852bb486923647a2d5198a2e85be46b22435429383aee9bbec98e4ee167d732fa872e83d05590fd
SSDEEP

1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211X:+dseIOMEZEyFjEOFqTiQm5l/5211X

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2776	omsecor.exe
1768	omsecor.exe
1580	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe
2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe
2776	omsecor.exe
2776	omsecor.exe
1768	omsecor.exe
1768	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2776	2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe	30
PID 2936 wrote to memory of 2776	2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe	30
PID 2936 wrote to memory of 2776	2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe	30
PID 2936 wrote to memory of 2776	2936	1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe	30
PID 2776 wrote to memory of 1768	2776	omsecor.exe	33
PID 2776 wrote to memory of 1768	2776	omsecor.exe	33
PID 2776 wrote to memory of 1768	2776	omsecor.exe	33
PID 2776 wrote to memory of 1768	2776	omsecor.exe	33
PID 1768 wrote to memory of 1580	1768	omsecor.exe	34
PID 1768 wrote to memory of 1580	1768	omsecor.exe	34
PID 1768 wrote to memory of 1580	1768	omsecor.exe	34
PID 1768 wrote to memory of 1580	1768	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe
"C:\Users\Admin\AppData\Local\Temp\1a937261ad09da2edbeb7e559c3f65bf03701384417f0c110f7e458a4a932a82N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
7ac5d1c3a85b1b2edfd164f471600df8

SHA1
0befad9cb4362694ab3028395d54bcd6e65ac1c7

SHA256
87badeff4b8952be8db77637fbc9a530d6faa2f6f50565e6b5a8b4f41a8eb13d

SHA512
fbd1219c48e071f3d950e4dc2bca8044d687a77a4f59b4c415d0e9d1bd90e62484033ac0467b65e9789032bb8f03d3fde725764b0ad6df89ae68a617250c154c

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
431659635728e53bea3d6c6ebde6d54b

SHA1
1a80524c9118834a269a626367270ca9e87358ab

SHA256
d046fba454870610ec302eefdbb9ddac8308fb24ae620203840407460fb7b88f

SHA512
4e0bcac0478538f34098177a8f1061db3bdc280fa2584fc60f04c3812e4943fd8a5c09f87d149c7f5401e2bf78fdbabcf5f74b380f4927bc8c5c1bcec50e65a3

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
51f5282c5d639912716989ccaa659621

SHA1
58da19f4777d864026c7624ff4b8b9dea2a1efcd

SHA256
6b0895d108373950c0c0cc0d64dcab9e10c4af119a5265030a20e291f77ed3e4

SHA512
e2873e606ef973d416159b3b55adca1f82d4ef22497a78fa858ed913081ccbd34717c9577efe1ac212be31336733aff382895d75c52e25506bc840f83a589316

Download Submit