neconyd | 11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe
Size

76KB
MD5

48ad7263b9b37f8977194f9c4bfc6070
SHA1

2357f8d7e4feb8b9396ee09784c2f6acde2d14dc
SHA256

11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42
SHA512

30b748fbff66f5ffb0bc7349202dd1bd1edfee763a5ac1d9455553e5712636e29956a912e3b97ed2f227302f43c60352d8d6d76e7dcac8044d05e6cfa2d6dd59
SSDEEP

1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11V:/dseIOMEZEyFjEOFqaiQm5l/5w11V

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
4056	omsecor.exe
2288	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4056	3780	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe	82
PID 3780 wrote to memory of 4056	3780	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe	82
PID 3780 wrote to memory of 4056	3780	11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe	82
PID 4056 wrote to memory of 2288	4056	omsecor.exe	92
PID 4056 wrote to memory of 2288	4056	omsecor.exe	92
PID 4056 wrote to memory of 2288	4056	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe
"C:\Users\Admin\AppData\Local\Temp\11ae9903a395a563272d35759059258b454f643edd9cba73be3d72b3a4d74b42N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
bf31ac27608788248f115eb1f218bf22

SHA1
ca1e30c69b926ff8b25be8220e4bcda08719a302

SHA256
42b749b981c46e1049e08e5b26731ecab689f95d3eb31cb4a2323bc65369eeec

SHA512
a29082302e48aa3020e5603e38aca2c2d5fb0f49443bf70c647dc748f09e918f81e72546b8ff83f727ac96d41ecff715de6f1526137ab1a9b2c9cc7291ba4ca3

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
0b87c6974a383ce9f3096bac249ae8f6

SHA1
ba90dc32d682c678352e0782c75fb3dc178c7b53

SHA256
0760c0c7462ea881fc8204e95b9a194649abeb5c34902fde4ab77038d67385fe

SHA512
ad4f21d36251b569bc13d5571f076f748009068d98d973ad6c9889be46a5c2d877976797c46fe51bfcdb0f586571c6d5760a352dafaac93f1f7321c06344676f

Download Submit
memory/2288-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2288-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3780-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3780-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4056-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4056-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4056-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download