neconyd | 4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Size

96KB
MD5

af98b54ac02a8e538c9860c63ee6c433
SHA1

8a3f3f3cd10d7b15fc395c80f8b0c75a46521b0a
SHA256

4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a
SHA512

b7d079bb199e16dc2d4c9e5dd05b4d0795e50f01e5355350ad9a6565d27eb8df172d91573d3df643cd8eabe72f5443d92164e4abc4d4c2c023be1232501c5299
SSDEEP

1536:wnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:wGs8cd8eXlYairZYqMddH13x

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2700	omsecor.exe
864	omsecor.exe
3244	omsecor.exe
4428	omsecor.exe
616	omsecor.exe
1036	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 2700 set thread context of 864	2700	omsecor.exe	88
PID 3244 set thread context of 4428	3244	omsecor.exe	110
PID 616 set thread context of 1036	616	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4788	1828	WerFault.exe	83
3352	2700	WerFault.exe	87
4444	3244	WerFault.exe	109
4820	616	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 1828 wrote to memory of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 1828 wrote to memory of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 1828 wrote to memory of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 1828 wrote to memory of 1832	1828	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	84
PID 1832 wrote to memory of 2700	1832	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	87
PID 1832 wrote to memory of 2700	1832	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	87
PID 1832 wrote to memory of 2700	1832	4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe	87
PID 2700 wrote to memory of 864	2700	omsecor.exe	88
PID 2700 wrote to memory of 864	2700	omsecor.exe	88
PID 2700 wrote to memory of 864	2700	omsecor.exe	88
PID 2700 wrote to memory of 864	2700	omsecor.exe	88
PID 2700 wrote to memory of 864	2700	omsecor.exe	88
PID 864 wrote to memory of 3244	864	omsecor.exe	109
PID 864 wrote to memory of 3244	864	omsecor.exe	109
PID 864 wrote to memory of 3244	864	omsecor.exe	109
PID 3244 wrote to memory of 4428	3244	omsecor.exe	110
PID 3244 wrote to memory of 4428	3244	omsecor.exe	110
PID 3244 wrote to memory of 4428	3244	omsecor.exe	110
PID 3244 wrote to memory of 4428	3244	omsecor.exe	110
PID 3244 wrote to memory of 4428	3244	omsecor.exe	110
PID 4428 wrote to memory of 616	4428	omsecor.exe	112
PID 4428 wrote to memory of 616	4428	omsecor.exe	112
PID 4428 wrote to memory of 616	4428	omsecor.exe	112
PID 616 wrote to memory of 1036	616	omsecor.exe	114
PID 616 wrote to memory of 1036	616	omsecor.exe	114
PID 616 wrote to memory of 1036	616	omsecor.exe	114
PID 616 wrote to memory of 1036	616	omsecor.exe	114
PID 616 wrote to memory of 1036	616	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
"C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
  C:\Users\Admin\AppData\Local\Temp\4636af7d7ebac14f5024fc789a641e3d395d77a44e5551a0d121243c8e735f2a.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3244
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 260
        8⤵
        Program crash
        
        PID:4820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 292
        6⤵
        Program crash
        
        PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 288
      4⤵
      Program crash
      PID:3352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 288
  2⤵
  - Program crash
  PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1828 -ip 1828
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2700 -ip 2700
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3244 -ip 3244
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 616 -ip 616
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5fdf8a539cbfc7a4ddb4e2b63728148e

SHA1
1e4695e2a665a7b7110ca907452576ed6c3e07eb

SHA256
b753c1c67276a091f67e33e02d362575628b2cf8991ac073ef284c3c6a94099f

SHA512
3604efa8615c138c604b53bf5f660c455ccd6ab2560c83b318260313774decb517c8072d33bd65030d0ffec7e8471b8643a83096cb80c2e99ae013238db67c9e

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
16b1da975050334288135bf69b33457d

SHA1
4215f0c481b3355aa03a31e58027e0d32b786155

SHA256
da89c5c65a40af0e1606620180bf9601e4cbc5d5a1ddd3a40439cafbb202855d

SHA512
6439d1c312a02002fc4c1f8889a196a9da950fee486876a38ab1cffe6a46f0c94df5fe89d63468bb08b254a084aa81e4f433c92e998190378e87180f4414344d

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3d98b747fdab29809911c6c51601f743

SHA1
26cbc4e372efed75f42859127ab21d160a36e539

SHA256
26e5887c5df90730f66107d1103c5ce159ca37deaaf0268da37d574916d70a9a

SHA512
71b503118f9ea822ec877a2b172425b6716b2a768de10fc6418f4a0ad7b972dfe3793c9113571949505b0af1afad2b4305bdc51ff74505b4f5323bfac1c75f96

Download Submit
memory/616-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/616-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/864-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1036-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1036-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1036-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1036-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1828-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1828-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1832-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1832-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1832-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1832-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2700-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2700-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3244-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3244-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4428-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download