neconyd | caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Size

96KB
MD5

2a21bd3663b336a53fb6610a5a68e495
SHA1

0bc123eb9012c2257ccce0b0a261a520fdaa2da5
SHA256

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa
SHA512

a00dae5aa007358aeec244faa7aa9a982c149c3eeb60caa1d2f875391aafc3f7846c5dbe8a4b429da72d3924ce796152786f80be0447f224ea5a264d5471ff64
SSDEEP

1536:/nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:/Gs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2816	omsecor.exe
2940	omsecor.exe
524	omsecor.exe
2348	omsecor.exe
2588	omsecor.exe
2208	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
2816	omsecor.exe
2940	omsecor.exe
2940	omsecor.exe
2348	omsecor.exe
2348	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2816 set thread context of 2940	2816	omsecor.exe	32
PID 524 set thread context of 2348	524	omsecor.exe	36
PID 2588 set thread context of 2208	2588	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 2868 wrote to memory of 3032	2868	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	30
PID 3032 wrote to memory of 2816	3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 3032 wrote to memory of 2816	3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 3032 wrote to memory of 2816	3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 3032 wrote to memory of 2816	3032	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	31
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2816 wrote to memory of 2940	2816	omsecor.exe	32
PID 2940 wrote to memory of 524	2940	omsecor.exe	35
PID 2940 wrote to memory of 524	2940	omsecor.exe	35
PID 2940 wrote to memory of 524	2940	omsecor.exe	35
PID 2940 wrote to memory of 524	2940	omsecor.exe	35
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 524 wrote to memory of 2348	524	omsecor.exe	36
PID 2348 wrote to memory of 2588	2348	omsecor.exe	37
PID 2348 wrote to memory of 2588	2348	omsecor.exe	37
PID 2348 wrote to memory of 2588	2348	omsecor.exe	37
PID 2348 wrote to memory of 2588	2348	omsecor.exe	37
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38
PID 2588 wrote to memory of 2208	2588	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
"C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:524
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
96d46c92a89199213da0b2a9d1a3776e

SHA1
6e6688fd1da8097e6f98b652d7aef3972b0dd0ce

SHA256
80de4aba7c2469b7ecbb60512c89a1ad1a42b9a9b2f179cf2e8606926645dfb0

SHA512
832a8c77b8b66cd027a66377648ff6e4ceda831cec86feab78614448d459315b11daf6ceb12f807f3968d9310f7c6d6bad90000421c9834d9d3766baca14a190

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
14b7d8a7f4215859946c1fadee4ce391

SHA1
34dc90e0c6d658e9381edf3b9e08f37d9b86460e

SHA256
74e69f8880e702f2d453ad23c75562fcb1fa3ab1ff3049e7c28b37175318c3bc

SHA512
092867adf82415bd4c359144c74f6f2e595fc4b12bc2cfb808374fcafb54e9cae9444a1a8e379ef7a73749eabf621a7afbb3d7b5caaecf331721cc1cc6abe8c0

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
b6a136568804836ea0c2a42062a9ac16

SHA1
9e0c0a85368cd8fc62637c49844650a8583703f5

SHA256
d32d3a3056db35e87cd8235a6a72637ce6f5b0fdbeb7dd593a67c8619abf5f70

SHA512
ccc5dfa65b7d8cbed73133351bd5e6318ec06f97487a1463ab6b26491db69b7a044d0fcd818ec169ed3f424a9357b6b9b5243a735fac94d7b5897ffde90b4221

Download Submit
memory/524-64-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2208-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2208-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2348-71-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2588-86-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2588-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-25-0x0000000000250000-0x0000000000273000-memory.dmp

Filesize
140KB

Download
memory/2816-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2868-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2868-11-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2868-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2940-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2940-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2940-48-0x00000000027A0000-0x00000000027C3000-memory.dmp

Filesize
140KB

Download
memory/2940-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2940-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2940-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download