neconyd | d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe
Size

80KB
MD5

3305fd01ff2b546d96e430ce2b038647
SHA1

6cf7578f1569816cb9af240863c614e5f95a63c7
SHA256

d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6
SHA512

889dc7490eb44e9763caf3bc20e5a9d54f8e5d562e4c4dc5816b47e790cd37008ec021878a89cd1b4c9e80da2a49838b9ac4db1ff86e476bf92d925a4f713996
SSDEEP

1536:md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzB:edseIOMEZEyFjEOFqTiQmOl/5xPvwN

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4840	omsecor.exe
2320	omsecor.exe
1592	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4840	4812	d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe	84
PID 4812 wrote to memory of 4840	4812	d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe	84
PID 4812 wrote to memory of 4840	4812	d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe	84
PID 4840 wrote to memory of 2320	4840	omsecor.exe	101
PID 4840 wrote to memory of 2320	4840	omsecor.exe	101
PID 4840 wrote to memory of 2320	4840	omsecor.exe	101
PID 2320 wrote to memory of 1592	2320	omsecor.exe	102
PID 2320 wrote to memory of 1592	2320	omsecor.exe	102
PID 2320 wrote to memory of 1592	2320	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe
"C:\Users\Admin\AppData\Local\Temp\d5bad112ac90f5d668331ecfb13d379426f5be4d26cb1bec44a7e2a76e0d89f6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
fc567419039e8405f433ad13c60b832a

SHA1
ad059a5137a29dbf2a326cedfdf685256d251829

SHA256
a6bb01398f0baae419a1bffc5abfd8b816f09ae63a4ab94fb4ca20cf7cbeee4c

SHA512
408da67eca43926672377e43c24e16bdaab837d9cc64a3305416e5809046e05013e38a1d5bc09ba1e26a1077cd29894bc078202789ef29956c29ada2c6b680e6

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
ad0407ac6e40c0920979e02254a3f518

SHA1
e2d6a509ace36c695286ee8307611451195fdef5

SHA256
e802e5c80849689f16e95d235c69e1389a3081da5a87c4eb40adda55e23e5373

SHA512
90a465d42f6152c25804efc16590c142ad8e2d40ec98f457d0c117b20abee838daa5e0496104300b7ec31924d72e6b38869f7fb2794ed9503129f5203653e89b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
69482e90f390d8ed726829841d36297f

SHA1
96c0c6a42e63ec8b3c7ad44574e470597b484edd

SHA256
937b8b575b0e1605e4a300340fdb4965d5ec3fd0e130c15ec839b7fbc98240d1

SHA512
adac6506a3507d9d15a548cd5ffc8de401ad0f20424336b1662f08e7d4993db7eba0cfdc97e96f1b1019b307843526005f0848b717ed37bf8493690a475ce453

Download Submit