neconyd | ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
Size

96KB
MD5

b59b72080e7876cbdce2a0d3421daa00
SHA1

52b65b37afe7dd6687b74d64d7b0aad38b9fe442
SHA256

ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248
SHA512

bd2289b4cb9d2ce70a2e690cda967086883722fb8cf3e7e2c1cfb612fcb08d6e6adb0f550739e5ee7cf4bda1925f999b8622ad1e275f7d561d2be347ad9b2214
SSDEEP

1536:pnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxR:pGs8cd8eXlYairZYqMddH13R

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2516	omsecor.exe
3364	omsecor.exe
3704	omsecor.exe
4140	omsecor.exe
1596	omsecor.exe
2712	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3096 set thread context of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 2516 set thread context of 3364	2516	omsecor.exe	88
PID 3704 set thread context of 4140	3704	omsecor.exe	108
PID 1596 set thread context of 2712	1596	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2312	3096	WerFault.exe	82
4776	2516	WerFault.exe	86
2768	3704	WerFault.exe	107
2120	1596	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 3096 wrote to memory of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 3096 wrote to memory of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 3096 wrote to memory of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 3096 wrote to memory of 4752	3096	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	83
PID 4752 wrote to memory of 2516	4752	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	86
PID 4752 wrote to memory of 2516	4752	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	86
PID 4752 wrote to memory of 2516	4752	ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe	86
PID 2516 wrote to memory of 3364	2516	omsecor.exe	88
PID 2516 wrote to memory of 3364	2516	omsecor.exe	88
PID 2516 wrote to memory of 3364	2516	omsecor.exe	88
PID 2516 wrote to memory of 3364	2516	omsecor.exe	88
PID 2516 wrote to memory of 3364	2516	omsecor.exe	88
PID 3364 wrote to memory of 3704	3364	omsecor.exe	107
PID 3364 wrote to memory of 3704	3364	omsecor.exe	107
PID 3364 wrote to memory of 3704	3364	omsecor.exe	107
PID 3704 wrote to memory of 4140	3704	omsecor.exe	108
PID 3704 wrote to memory of 4140	3704	omsecor.exe	108
PID 3704 wrote to memory of 4140	3704	omsecor.exe	108
PID 3704 wrote to memory of 4140	3704	omsecor.exe	108
PID 3704 wrote to memory of 4140	3704	omsecor.exe	108
PID 4140 wrote to memory of 1596	4140	omsecor.exe	110
PID 4140 wrote to memory of 1596	4140	omsecor.exe	110
PID 4140 wrote to memory of 1596	4140	omsecor.exe	110
PID 1596 wrote to memory of 2712	1596	omsecor.exe	112
PID 1596 wrote to memory of 2712	1596	omsecor.exe	112
PID 1596 wrote to memory of 2712	1596	omsecor.exe	112
PID 1596 wrote to memory of 2712	1596	omsecor.exe	112
PID 1596 wrote to memory of 2712	1596	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
"C:\Users\Admin\AppData\Local\Temp\ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
  C:\Users\Admin\AppData\Local\Temp\ba655344919a158eba14ec04bd7171c503b8b1229e96771c6d82e09e0a0b5248.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3704
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 256
        8⤵
        Program crash
        
        PID:2120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 292
        6⤵
        Program crash
        
        PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 288
      4⤵
      Program crash
      PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 288
  2⤵
  - Program crash
  PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2516 -ip 2516
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3704 -ip 3704
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1596 -ip 1596
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
52686ba6620bc83f3d6ffb6607000ca5

SHA1
362143218b07025d799a35b93038f6a0304fd829

SHA256
930533cc4e345a23551dc390a619b0008a6e9edcda576a0563fd4b8cb3f165dd

SHA512
8a34146ee674d420bd95f1104c9accd5e412acad1de59c269fdc2bca87e8568eb3905a6f471060ff771d587ea2129fcd7617b8e47ad14e3d5d00e0872cda255d

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
08b11d8397bff0b1946992f3a73e2f32

SHA1
354c8603535a1116bbb9bb1549bd01f36168418c

SHA256
aff1962c067240ec722df9c1e4e3923c922f8f21dafd5925cfde6292318c75b7

SHA512
96118a4dd9d5809359e749fdb07fec87f12af039aca724373697480dce75679f0e3e99d4dd56df6915e6e9e1e00176cfa842ea93fb116ac62b620af9ee2cc753

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
39f51ab8243a1e0ad2ee73d99d3b64b5

SHA1
93198f4370a151dedf686b54d817afc43723185a

SHA256
4f477ea971b0581b15212eb2d4790f74eb6792abc8ca9c4e05b4f80a1980f13e

SHA512
1664010c0dc05be26532ee79d3f398b309614bcd8cddf1b34f72d2a6f5dac7e01a147c9beb3dc4b1267882097266d4c08c73cd39860c43d8b2f6dd38acc8005b

Download Submit
memory/1596-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1596-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2712-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2712-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3096-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3096-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3364-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3704-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4140-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4140-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4140-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4752-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4752-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4752-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4752-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download