neconyd | caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Size

96KB
MD5

2a21bd3663b336a53fb6610a5a68e495
SHA1

0bc123eb9012c2257ccce0b0a261a520fdaa2da5
SHA256

caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa
SHA512

a00dae5aa007358aeec244faa7aa9a982c149c3eeb60caa1d2f875391aafc3f7846c5dbe8a4b429da72d3924ce796152786f80be0447f224ea5a264d5471ff64
SSDEEP

1536:/nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:/Gs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3948	omsecor.exe
1236	omsecor.exe
428	omsecor.exe
4108	omsecor.exe
4908	omsecor.exe
2408	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3536 set thread context of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 3948 set thread context of 1236	3948	omsecor.exe	87
PID 428 set thread context of 4108	428	omsecor.exe	109
PID 4908 set thread context of 2408	4908	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4600	3536	WerFault.exe	82
3808	3948	WerFault.exe	86
4732	428	WerFault.exe	108
4736	4908	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 3536 wrote to memory of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 3536 wrote to memory of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 3536 wrote to memory of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 3536 wrote to memory of 2848	3536	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	83
PID 2848 wrote to memory of 3948	2848	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 2848 wrote to memory of 3948	2848	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 2848 wrote to memory of 3948	2848	caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe	86
PID 3948 wrote to memory of 1236	3948	omsecor.exe	87
PID 3948 wrote to memory of 1236	3948	omsecor.exe	87
PID 3948 wrote to memory of 1236	3948	omsecor.exe	87
PID 3948 wrote to memory of 1236	3948	omsecor.exe	87
PID 3948 wrote to memory of 1236	3948	omsecor.exe	87
PID 1236 wrote to memory of 428	1236	omsecor.exe	108
PID 1236 wrote to memory of 428	1236	omsecor.exe	108
PID 1236 wrote to memory of 428	1236	omsecor.exe	108
PID 428 wrote to memory of 4108	428	omsecor.exe	109
PID 428 wrote to memory of 4108	428	omsecor.exe	109
PID 428 wrote to memory of 4108	428	omsecor.exe	109
PID 428 wrote to memory of 4108	428	omsecor.exe	109
PID 428 wrote to memory of 4108	428	omsecor.exe	109
PID 4108 wrote to memory of 4908	4108	omsecor.exe	111
PID 4108 wrote to memory of 4908	4108	omsecor.exe	111
PID 4108 wrote to memory of 4908	4108	omsecor.exe	111
PID 4908 wrote to memory of 2408	4908	omsecor.exe	112
PID 4908 wrote to memory of 2408	4908	omsecor.exe	112
PID 4908 wrote to memory of 2408	4908	omsecor.exe	112
PID 4908 wrote to memory of 2408	4908	omsecor.exe	112
PID 4908 wrote to memory of 2408	4908	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
"C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  C:\Users\Admin\AppData\Local\Temp\caa7bdf03729ac5ad10f7df1824b7ef70e9f331aeda2e74dae38a341bd693baa.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 268
        8⤵
        Program crash
        
        PID:4736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 292
        6⤵
        Program crash
        
        PID:4732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 288
      4⤵
      Program crash
      PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 288
  2⤵
  - Program crash
  PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3536 -ip 3536
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3948 -ip 3948
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 428 -ip 428
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4908 -ip 4908
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
37b036414408346144b72c94dc10ecae

SHA1
bc197055670ae16b165880b52dd7dd0537d3195d

SHA256
aab3f96e71e1b4c1eb45e3db2377cbaadcf990d60f0ac2882826187d88d8987e

SHA512
805432417a3085556b79da5b2a772dbe17cddf47925f65be3d980cdc9cce3907dfead0c3e8ca0c8402fad1d6b07949e7d37988eded1582f10e78d63fce3788c3

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
96d46c92a89199213da0b2a9d1a3776e

SHA1
6e6688fd1da8097e6f98b652d7aef3972b0dd0ce

SHA256
80de4aba7c2469b7ecbb60512c89a1ad1a42b9a9b2f179cf2e8606926645dfb0

SHA512
832a8c77b8b66cd027a66377648ff6e4ceda831cec86feab78614448d459315b11daf6ceb12f807f3968d9310f7c6d6bad90000421c9834d9d3766baca14a190

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
aaf298ce0bd932aea43156e69952501d

SHA1
d53fdd41ba59a3a7e61dea9f6265370f135418a1

SHA256
4e44139d27c426dd9a99de816a4487aa2459a56d8ef672b5cc83764245f9e9f7

SHA512
d04dedb335a093820bde1e851a58c743b068817bd495c2afb089fa63d0bc2e49cceaa857eb30b2dbb25e1264a7266c1d672e6bd5f00799d57d4825235c6a545d

Download Submit
memory/428-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/428-35-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1236-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2848-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2848-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2848-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2848-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3536-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3536-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3948-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3948-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4108-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4108-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4108-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4908-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download