neconyd | caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa

Analysis

max time kernel
116s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Size

96KB
MD5

2a21bd3663b336a53fb6610a5a68e495
SHA1

0bc123eb9012c2257ccce0b0a261a520fdaa2da5
SHA256

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa
SHA512

a00dae5aa007358aeec244faa7aa9a982c149c3eeb60caa1d2f875391aafc3f7846c5dbe8a4b429da72d3924ce796152786f80be0447f224ea5a264d5471ff64
SSDEEP

1536:/nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:/Gs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
5032	omsecor.exe
1636	omsecor.exe
224	omsecor.exe
3856	omsecor.exe
4292	omsecor.exe
3604	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 5032 set thread context of 1636	5032	omsecor.exe	88
PID 224 set thread context of 3856	224	omsecor.exe	110
PID 4292 set thread context of 3604	4292	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3884	4936	WerFault.exe	82
836	5032	WerFault.exe	86
3928	224	WerFault.exe	109
4624	4292	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 4936 wrote to memory of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 4936 wrote to memory of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 4936 wrote to memory of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 4936 wrote to memory of 1516	4936	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 1516 wrote to memory of 5032	1516	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 1516 wrote to memory of 5032	1516	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 1516 wrote to memory of 5032	1516	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 5032 wrote to memory of 1636	5032	omsecor.exe	88
PID 5032 wrote to memory of 1636	5032	omsecor.exe	88
PID 5032 wrote to memory of 1636	5032	omsecor.exe	88
PID 5032 wrote to memory of 1636	5032	omsecor.exe	88
PID 5032 wrote to memory of 1636	5032	omsecor.exe	88
PID 1636 wrote to memory of 224	1636	omsecor.exe	109
PID 1636 wrote to memory of 224	1636	omsecor.exe	109
PID 1636 wrote to memory of 224	1636	omsecor.exe	109
PID 224 wrote to memory of 3856	224	omsecor.exe	110
PID 224 wrote to memory of 3856	224	omsecor.exe	110
PID 224 wrote to memory of 3856	224	omsecor.exe	110
PID 224 wrote to memory of 3856	224	omsecor.exe	110
PID 224 wrote to memory of 3856	224	omsecor.exe	110
PID 3856 wrote to memory of 4292	3856	omsecor.exe	112
PID 3856 wrote to memory of 4292	3856	omsecor.exe	112
PID 3856 wrote to memory of 4292	3856	omsecor.exe	112
PID 4292 wrote to memory of 3604	4292	omsecor.exe	113
PID 4292 wrote to memory of 3604	4292	omsecor.exe	113
PID 4292 wrote to memory of 3604	4292	omsecor.exe	113
PID 4292 wrote to memory of 3604	4292	omsecor.exe	113
PID 4292 wrote to memory of 3604	4292	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
"C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 256
        8⤵
        Program crash
        
        PID:4624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 292
        6⤵
        Program crash
        
        PID:3928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 300
      4⤵
      Program crash
      PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 288
  2⤵
  - Program crash
  PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4936 -ip 4936
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5032 -ip 5032
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 224 -ip 224
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4292 -ip 4292
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
225b7f4dff3b6103c7b4a202e3ef1cd5

SHA1
7b422a7a43716cb5c1b1de004325e7fc678a877b

SHA256
5032647ee9e9d6a0a67c2f3e85b6f1278477522d2aea63949e3b4ffbc2c554a2

SHA512
fd856d37ce8521c87220dfa6c00f7ce76753866bd2d975936404f8b5e0c90c90beb4370d2f575b666c76e89d8679a8e06e3abd631ad191505d86352842aa13a7

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
96d46c92a89199213da0b2a9d1a3776e

SHA1
6e6688fd1da8097e6f98b652d7aef3972b0dd0ce

SHA256
80de4aba7c2469b7ecbb60512c89a1ad1a42b9a9b2f179cf2e8606926645dfb0

SHA512
832a8c77b8b66cd027a66377648ff6e4ceda831cec86feab78614448d459315b11daf6ceb12f807f3968d9310f7c6d6bad90000421c9834d9d3766baca14a190

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
5e1bd6fa3669916edf1be44eced826ec

SHA1
b2f8eae6f5a4d5260a5b266a074eed4fedcabc35

SHA256
6b96956cd0fd96fe41c0ed9b093e497b61fc133da38ef116039dfc1786871c62

SHA512
7581bdf760ac8aa39b03bff93879037b2397ef7d2cb5f736f479866883c5fec3782166dd7464f2a09e7ba4a91a12b0cef699510511271b5a65d7122280db6cd8

Download Submit
memory/224-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/224-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1516-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1516-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1516-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1636-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3604-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3604-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3604-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3856-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3856-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3856-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4292-44-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4936-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4936-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5032-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5032-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download