neconyd | 0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Size

96KB
MD5

d1089bf6eeff7a890d0757d7e20e5cbc
SHA1

efc1a74abe9efface024d2e3b19723e0ce383ceb
SHA256

0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896
SHA512

a44f7521b15744450ed40d0ee1d067c9808d58f6014b882409e5458d5a3d786a2f7d26ba4b07cbdd1ef241592739d313e5bb710895f00e31d45afe92c03d1a59
SSDEEP

1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1128	omsecor.exe
3264	omsecor.exe
2448	omsecor.exe
1960	omsecor.exe
3248	omsecor.exe
4600	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 1128 set thread context of 3264	1128	omsecor.exe	87
PID 2448 set thread context of 1960	2448	omsecor.exe	108
PID 3248 set thread context of 4600	3248	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
768	3172	WerFault.exe	82
772	1128	WerFault.exe	85
732	2448	WerFault.exe	107
3544	3248	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 3172 wrote to memory of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 3172 wrote to memory of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 3172 wrote to memory of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 3172 wrote to memory of 5052	3172	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	83
PID 5052 wrote to memory of 1128	5052	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	85
PID 5052 wrote to memory of 1128	5052	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	85
PID 5052 wrote to memory of 1128	5052	0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe	85
PID 1128 wrote to memory of 3264	1128	omsecor.exe	87
PID 1128 wrote to memory of 3264	1128	omsecor.exe	87
PID 1128 wrote to memory of 3264	1128	omsecor.exe	87
PID 1128 wrote to memory of 3264	1128	omsecor.exe	87
PID 1128 wrote to memory of 3264	1128	omsecor.exe	87
PID 3264 wrote to memory of 2448	3264	omsecor.exe	107
PID 3264 wrote to memory of 2448	3264	omsecor.exe	107
PID 3264 wrote to memory of 2448	3264	omsecor.exe	107
PID 2448 wrote to memory of 1960	2448	omsecor.exe	108
PID 2448 wrote to memory of 1960	2448	omsecor.exe	108
PID 2448 wrote to memory of 1960	2448	omsecor.exe	108
PID 2448 wrote to memory of 1960	2448	omsecor.exe	108
PID 2448 wrote to memory of 1960	2448	omsecor.exe	108
PID 1960 wrote to memory of 3248	1960	omsecor.exe	110
PID 1960 wrote to memory of 3248	1960	omsecor.exe	110
PID 1960 wrote to memory of 3248	1960	omsecor.exe	110
PID 3248 wrote to memory of 4600	3248	omsecor.exe	112
PID 3248 wrote to memory of 4600	3248	omsecor.exe	112
PID 3248 wrote to memory of 4600	3248	omsecor.exe	112
PID 3248 wrote to memory of 4600	3248	omsecor.exe	112
PID 3248 wrote to memory of 4600	3248	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
"C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
  C:\Users\Admin\AppData\Local\Temp\0b12e29b9752eeb4790ff38e7fb500064174730d83c91e5c2677cfdc22eb0896.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2448
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 256
        8⤵
        Program crash
        
        PID:3544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 292
        6⤵
        Program crash
        
        PID:732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 288
      4⤵
      Program crash
      PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 288
  2⤵
  - Program crash
  PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3172 -ip 3172
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1128 -ip 1128
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2448 -ip 2448
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3248 -ip 3248
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
741d94a4e2e99f04e0ef558e9fdbfc53

SHA1
0bcc87ce92aedb13c33e0ab18fbf4b46a5d757a2

SHA256
ee9f1c69072332bc955fc5fdabc1edd544984af5fb649e094f1a5b7f191e03d8

SHA512
f767cf7aedee1f40a70e20543a7eaee358e0cd0c4d1b350db650890fb1345b630fcf029554cc85d21a66bda13863438edac9672e8696949b547ad6555b8ee936

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f41db0ae240c8ac36f974bc8af6937ff

SHA1
f98cbdfdb644c5210519e386f37311caa6c555ff

SHA256
5ffd1065108b397345194b9a84034769ee90a0209a083e3340a65027e86e5033

SHA512
e5d5c69dc0746fd76c1a910f6aed8eb97a94b71f8d60c52e1ddb9e8e7988aa9b559205f2433a62022b24272117374106f0c59d28dda35f2a4db3bfae93637769

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
85d5660b0e408da259cc245485edb6aa

SHA1
c43e7ed9b378ab6154d2f6dbb34dee42b0b56e20

SHA256
9317cbe7791a4c253525bb72e646f7996ae9547edb42097b883e3a38690f1d11

SHA512
be1759557c169ab49a260fab1638efb13b75814400626364b5676417d750ec5ccb7de5d9ab1207a84becff8acc15245f413519d04ee0468648b2acbcebbca68c

Download Submit
memory/1128-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1128-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1960-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1960-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1960-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2448-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2448-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3172-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3172-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3248-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3264-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4600-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4600-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4600-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4600-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5052-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5052-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5052-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5052-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download