neconyd | 4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Size

96KB
MD5

af98b54ac02a8e538c9860c63ee6c433
SHA1

8a3f3f3cd10d7b15fc395c80f8b0c75a46521b0a
SHA256

4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a
SHA512

b7d079bb199e16dc2d4c9e5dd05b4d0795e50f01e5355350ad9a6565d27eb8df172d91573d3df643cd8eabe72f5443d92164e4abc4d4c2c023be1232501c5299
SSDEEP

1536:wnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:wGs8cd8eXlYairZYqMddH13x

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2864	omsecor.exe
2796	omsecor.exe
1604	omsecor.exe
2244	omsecor.exe
1248	omsecor.exe
1644	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
2864	omsecor.exe
2796	omsecor.exe
2796	omsecor.exe
2244	omsecor.exe
2244	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2864 set thread context of 2796	2864	omsecor.exe	32
PID 1604 set thread context of 2244	1604	omsecor.exe	36
PID 1248 set thread context of 1644	1248	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2468 wrote to memory of 2080	2468	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	30
PID 2080 wrote to memory of 2864	2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	31
PID 2080 wrote to memory of 2864	2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	31
PID 2080 wrote to memory of 2864	2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	31
PID 2080 wrote to memory of 2864	2080	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	31
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2864 wrote to memory of 2796	2864	omsecor.exe	32
PID 2796 wrote to memory of 1604	2796	omsecor.exe	35
PID 2796 wrote to memory of 1604	2796	omsecor.exe	35
PID 2796 wrote to memory of 1604	2796	omsecor.exe	35
PID 2796 wrote to memory of 1604	2796	omsecor.exe	35
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 1604 wrote to memory of 2244	1604	omsecor.exe	36
PID 2244 wrote to memory of 1248	2244	omsecor.exe	37
PID 2244 wrote to memory of 1248	2244	omsecor.exe	37
PID 2244 wrote to memory of 1248	2244	omsecor.exe	37
PID 2244 wrote to memory of 1248	2244	omsecor.exe	37
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38
PID 1248 wrote to memory of 1644	1248	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
"C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
  C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
16b1da975050334288135bf69b33457d

SHA1
4215f0c481b3355aa03a31e58027e0d32b786155

SHA256
da89c5c65a40af0e1606620180bf9601e4cbc5d5a1ddd3a40439cafbb202855d

SHA512
6439d1c312a02002fc4c1f8889a196a9da950fee486876a38ab1cffe6a46f0c94df5fe89d63468bb08b254a084aa81e4f433c92e998190378e87180f4414344d

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
0ce88949371ffa0cdc73dd6a00120ad3

SHA1
37f33cd5d0b0f6cf9e1af5239d21337fb8b523a6

SHA256
ea1852097651670b5dcfacb46178d7f4c757d86dfc94f48e1cabd646cbdfd819

SHA512
cac56fe40648bdf687911e04057d6c71878e58b8eb4e8424fb62e24ee4568678a5ae07d8f1023bbfcef09bcdcc7ba4bb65bb09487bac2d9cda74c2a37dd0dd94

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
76e379d8f16d620b4f69f66f7710c681

SHA1
6cf50fdaab92c3e2d1a513a3fb3c5c3db552fde2

SHA256
298bd52c3cbfcd5a60516bb4cfa6538682abcac65228524de685e4eb2109475b

SHA512
2dfbdfc4541d9f6f5858b02eb812489584aecc9fef5ccb82d43de62f5bec2d29620e95435e7d080053ae26f8af0c0367b21c9c1026ada042f24276e458676c85

Download Submit
memory/1248-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1604-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1604-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1644-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1644-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2080-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2080-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2080-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2080-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2244-73-0x00000000002C0000-0x00000000002E3000-memory.dmp

Filesize
140KB

Download
memory/2468-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2468-34-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2468-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2796-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-54-0x0000000001F80000-0x0000000001FA3000-memory.dmp

Filesize
140KB

Download
memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-48-0x0000000001F80000-0x0000000001FA3000-memory.dmp

Filesize
140KB

Download
memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2864-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2864-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download