neconyd | e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359ead

Analysis

max time kernel
115s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
Size

134KB
MD5

7f22c9c284b4cb5cca87ad679107e010
SHA1

246f2beb44f05b708b3c102bad5bd2f95b319b43
SHA256

e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359ead
SHA512

6174a15c772b7868be6ace49cb4a0180a68cfb3968dd241aaa3f0920dabd452f9e5a771cfc9462205e1fbf6af4bc368d2d80e1357814190d3ebabed05d22a3e3
SSDEEP

1536:GDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:4iRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2144	omsecor.exe
1804	omsecor.exe
804	omsecor.exe
1064	omsecor.exe
1664	omsecor.exe
1780	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
2144	omsecor.exe
1804	omsecor.exe
1804	omsecor.exe
1064	omsecor.exe
1064	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2144 set thread context of 1804	2144	omsecor.exe	32
PID 804 set thread context of 1064	804	omsecor.exe	36
PID 1664 set thread context of 1780	1664	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 2424 wrote to memory of 3012	2424	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	30
PID 3012 wrote to memory of 2144	3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	31
PID 3012 wrote to memory of 2144	3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	31
PID 3012 wrote to memory of 2144	3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	31
PID 3012 wrote to memory of 2144	3012	e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe	31
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 2144 wrote to memory of 1804	2144	omsecor.exe	32
PID 1804 wrote to memory of 804	1804	omsecor.exe	35
PID 1804 wrote to memory of 804	1804	omsecor.exe	35
PID 1804 wrote to memory of 804	1804	omsecor.exe	35
PID 1804 wrote to memory of 804	1804	omsecor.exe	35
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 804 wrote to memory of 1064	804	omsecor.exe	36
PID 1064 wrote to memory of 1664	1064	omsecor.exe	37
PID 1064 wrote to memory of 1664	1064	omsecor.exe	37
PID 1064 wrote to memory of 1664	1064	omsecor.exe	37
PID 1064 wrote to memory of 1664	1064	omsecor.exe	37
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38
PID 1664 wrote to memory of 1780	1664	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
"C:\Users\Admin\AppData\Local\Temp\e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
  C:\Users\Admin\AppData\Local\Temp\e3ed237dcfe4eec0c76c8cb244887064226ab99cf7ee2c7fa7b5899c69359eadN.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:804
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
18668d61121192e11537698f2eb97846

SHA1
d01fe865e9d8fe97739a63286ddd4616fad422b0

SHA256
8963b2320e25b958b27a0887bd29fe287339eb4e3423d842705b883fcb70a2bc

SHA512
56c6f7938e0aa2200009ed08b0377e4d08a157a2af045c29512222cd45b663ffc5392c03b2b0561d9bbf96a9a88f8dab87837f8b5dfd8afdd494450b9f785861

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
4cf9041c8ed4431dc0115fbc5caecd0b

SHA1
e32ba1ef85d66de0be92410dfc167470b5a6386e

SHA256
6e6857a6ee952cf2e83916db3f406f1e14f94ff1cf8310d65593a056520496b4

SHA512
56f75bd6249d86bc79c19e1445a965dc606f03b1da1140d6f2a09d9cf98c800d21737e87384eb8b6defe4ec6e24404542b80fac48e5ad8820d87def2ae2814f1

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
e191f458509dcee9f8bf3c686828ba6b

SHA1
690cde0672f67ace2650f0ae1d6fd35294334a26

SHA256
8c6e22cdd00c950d0edcd3a711b4baab6a2b3c5dad78d193ca1c2abb227c1d0c

SHA512
0502d2b24e4a60a9e6d198321a9f8725482b91563cb753f7d41fb81bbb14461dce1ed6246f4aea79eeeb60d166ada599eeb5dfce0c6f67113d060b42822c7e25

Download Submit
memory/804-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/804-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1064-68-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1664-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1664-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1780-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1804-45-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/2144-28-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2144-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2424-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2424-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3012-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3012-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3012-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3012-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download