neconyd | 0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Size

96KB
MD5

d1089bf6eeff7a890d0757d7e20e5cbc
SHA1

efc1a74abe9efface024d2e3b19723e0ce383ceb
SHA256

0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896
SHA512

a44f7521b15744450ed40d0ee1d067c9808d58f6014b882409e5458d5a3d786a2f7d26ba4b07cbdd1ef241592739d313e5bb710895f00e31d45afe92c03d1a59
SSDEEP

1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2292	omsecor.exe
2540	omsecor.exe
1676	omsecor.exe
1728	omsecor.exe
2924	omsecor.exe
2100	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
2292	omsecor.exe
2540	omsecor.exe
2540	omsecor.exe
1728	omsecor.exe
1728	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2292 set thread context of 2540	2292	omsecor.exe	32
PID 1676 set thread context of 1728	1676	omsecor.exe	36
PID 2924 set thread context of 2100	2924	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 2988 wrote to memory of 848	2988	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	30
PID 848 wrote to memory of 2292	848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	31
PID 848 wrote to memory of 2292	848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	31
PID 848 wrote to memory of 2292	848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	31
PID 848 wrote to memory of 2292	848	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	31
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2292 wrote to memory of 2540	2292	omsecor.exe	32
PID 2540 wrote to memory of 1676	2540	omsecor.exe	35
PID 2540 wrote to memory of 1676	2540	omsecor.exe	35
PID 2540 wrote to memory of 1676	2540	omsecor.exe	35
PID 2540 wrote to memory of 1676	2540	omsecor.exe	35
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1676 wrote to memory of 1728	1676	omsecor.exe	36
PID 1728 wrote to memory of 2924	1728	omsecor.exe	37
PID 1728 wrote to memory of 2924	1728	omsecor.exe	37
PID 1728 wrote to memory of 2924	1728	omsecor.exe	37
PID 1728 wrote to memory of 2924	1728	omsecor.exe	37
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38
PID 2924 wrote to memory of 2100	2924	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
"C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
  C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f41db0ae240c8ac36f974bc8af6937ff

SHA1
f98cbdfdb644c5210519e386f37311caa6c555ff

SHA256
5ffd1065108b397345194b9a84034769ee90a0209a083e3340a65027e86e5033

SHA512
e5d5c69dc0746fd76c1a910f6aed8eb97a94b71f8d60c52e1ddb9e8e7988aa9b559205f2433a62022b24272117374106f0c59d28dda35f2a4db3bfae93637769

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
7e3a62e228a50b6d6667806ba1c67fad

SHA1
cbddfc1b63578f5682d3565a9300c0ab79b59d3c

SHA256
75c974746519a0854612868c2efb55a3b982120d9c318211314da99d5024db22

SHA512
25ca417774483d208e78dda782baba29ed427fa46273f7a7dcbe07a3ffa74f093a97007355cdf7963a87f420260ccb3c182a94d7515f38fe6550fe96ffb9e52c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
371d1eefbd956e2af721a737283d0f9f

SHA1
68867841a261121fd416951c36cb3037e7d19b17

SHA256
e70831902248df5496e765d0c059dea0b57c8a9550e738b4ede6399bfd5549fb

SHA512
d345e2329448deb6f5ac5390bbe7ac9584db18c7e470e2e9cd52d4430d003bd36cac1e89fd9b2d18ba0459bf4b4808e4fe01b59ce319ce52380e08a351d39dbe

Download Submit
memory/848-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/848-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/848-20-0x00000000005C0000-0x00000000005E3000-memory.dmp

Filesize
140KB

Download
memory/848-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/848-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/848-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1676-60-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1676-69-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2100-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2100-95-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2292-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2292-27-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2292-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2540-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2540-46-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2540-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2540-56-0x0000000000530000-0x0000000000553000-memory.dmp

Filesize
140KB

Download
memory/2540-55-0x0000000000530000-0x0000000000553000-memory.dmp

Filesize
140KB

Download
memory/2540-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2540-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-82-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2924-90-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2988-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2988-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download