neconyd | 11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6

Analysis

max time kernel
114s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe
Size

76KB
MD5

5018c87cd0f8eb82a4e26033be36b218
SHA1

f1a5372ea62b5f6721675b867606896e8e9c7d77
SHA256

11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6
SHA512

ec7287fc0a0934dc2bfd91ca6c6363e3315050ff46cabd906cbfb60cc4f12e5965a49278bd67f4827406f1d7ccd46d5d8c3a6d192305c2c5d984d122aba7fde7
SSDEEP

1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11l:1dseIOMEZEyFjEOFqaiQm5l/5w11l

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2832	omsecor.exe
2924	omsecor.exe
1220	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2832	2612	11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe	82
PID 2612 wrote to memory of 2832	2612	11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe	82
PID 2612 wrote to memory of 2832	2612	11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe	82
PID 2832 wrote to memory of 2924	2832	omsecor.exe	92
PID 2832 wrote to memory of 2924	2832	omsecor.exe	92
PID 2832 wrote to memory of 2924	2832	omsecor.exe	92
PID 2924 wrote to memory of 1220	2924	omsecor.exe	93
PID 2924 wrote to memory of 1220	2924	omsecor.exe	93
PID 2924 wrote to memory of 1220	2924	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe
"C:\Users\Admin\AppData\Local\Temp\11b301a791e05917a86109e1b12e5cb17e29e2269cb5fbbab4f74a4d44991cc6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
174b858842776ae993a4a9a304d602a6

SHA1
25e7317c031e2843336c31d08b2f022865afc616

SHA256
da85e95bc47b9de0a24aae4f79c5ac79bbd1f876a8bbfe3fc4fe0dd715241085

SHA512
16c7ff13e20d69e4f0d7aa6375c67daaaf935ae15de98a1aeb2cefaf5e7ed54484d115299510012a7a4c865cfe9025ab32f461f7c5b7d6107280a8d4f2e469ca

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
29edb954d2a41c8cf32f1a79732c4ede

SHA1
301584d7be7d3490e8047dca7a01db7f1daad019

SHA256
3689c8da24a86bf7d7a8d612bff946d19740ce475bbf2c0a8af179080811ce11

SHA512
6bccfa8fb3ec2ee639b606174d84090609afb7040bf2d1ee4ab46cbe97f07284e13f7808e4381b9543e48eaead26fa4cd345598c602e2ba986cfa06b64991c3c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
b9a9ab8231f8fac17414bafe4ad919b4

SHA1
616e5296ce7397769a9239a49d7a54784471998d

SHA256
7eed53b44c74e66a96a578726987bfc51b8055334606091efb2a2d6060776aa4

SHA512
e9741b568489cccf61c93b2886f882fe0df304a83899a9d1ac2e72b2632b9741869bf476ddd4bcaa1b9be455072cb270908c2cdc64d3df8181665a08da5ff964

Download Submit
memory/1220-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1220-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2612-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2612-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2832-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2832-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2832-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2924-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2924-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download