neconyd | caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Size

96KB
MD5

2a21bd3663b336a53fb6610a5a68e495
SHA1

0bc123eb9012c2257ccce0b0a261a520fdaa2da5
SHA256

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa
SHA512

a00dae5aa007358aeec244faa7aa9a982c149c3eeb60caa1d2f875391aafc3f7846c5dbe8a4b429da72d3924ce796152786f80be0447f224ea5a264d5471ff64
SSDEEP

1536:/nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:/Gs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2804	omsecor.exe
2832	omsecor.exe
2876	omsecor.exe
1944	omsecor.exe
1976	omsecor.exe
2180	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
2804	omsecor.exe
2832	omsecor.exe
2832	omsecor.exe
1944	omsecor.exe
1944	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2804 set thread context of 2832	2804	omsecor.exe	32
PID 2876 set thread context of 1944	2876	omsecor.exe	36
PID 1976 set thread context of 2180	1976	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3040 wrote to memory of 2660	3040	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2660 wrote to memory of 2804	2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 2660 wrote to memory of 2804	2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 2660 wrote to memory of 2804	2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 2660 wrote to memory of 2804	2660	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2804 wrote to memory of 2832	2804	omsecor.exe	32
PID 2832 wrote to memory of 2876	2832	omsecor.exe	35
PID 2832 wrote to memory of 2876	2832	omsecor.exe	35
PID 2832 wrote to memory of 2876	2832	omsecor.exe	35
PID 2832 wrote to memory of 2876	2832	omsecor.exe	35
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 2876 wrote to memory of 1944	2876	omsecor.exe	36
PID 1944 wrote to memory of 1976	1944	omsecor.exe	37
PID 1944 wrote to memory of 1976	1944	omsecor.exe	37
PID 1944 wrote to memory of 1976	1944	omsecor.exe	37
PID 1944 wrote to memory of 1976	1944	omsecor.exe	37
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38
PID 1976 wrote to memory of 2180	1976	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
"C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
96d46c92a89199213da0b2a9d1a3776e

SHA1
6e6688fd1da8097e6f98b652d7aef3972b0dd0ce

SHA256
80de4aba7c2469b7ecbb60512c89a1ad1a42b9a9b2f179cf2e8606926645dfb0

SHA512
832a8c77b8b66cd027a66377648ff6e4ceda831cec86feab78614448d459315b11daf6ceb12f807f3968d9310f7c6d6bad90000421c9834d9d3766baca14a190

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5cd8da9865429523391e8fd95078d78d

SHA1
09c871bee11af965dd3ca1dec2406a1b8a01c778

SHA256
aa609df523cc1ea0ca87d2263cb1b9eae48472bd286c2be1fb1c02a90208d8ce

SHA512
31c9330824a71d49cef40b3082e3407abecd63edaaecbf490db54132386009d3a39f6e416eb458476daf343b152f0d3e3f9f1d75684db286b136181e9c41df3c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
d9529b0f9a2ed364e4bb3a4f3332927c

SHA1
ff312ab5fb71e38e3aba1728a9f2c9cb7c84a5d8

SHA256
b0f4bf5dbe8f8e9c7afe741461e685fe9f9d5e85eee62054cc4c928713769d0d

SHA512
628c801228a9d474cd038fbf0d21b648029ef349e92b249275aac336239d32077631e4ffb344a617e71c29b72fd0479c7bdad633a5c84ca302e310e8eea0c4ac

Download Submit
memory/1944-77-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/1944-89-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/1976-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1976-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2180-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2804-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2804-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2804-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2832-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2832-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2832-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2832-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2876-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2876-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3040-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3040-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download