neconyd | c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
Size

96KB
MD5

4d7565fd278b35592d7e4be90523b770
SHA1

fd9c3504f56ee5596f7249bed151ca87823f1b46
SHA256

c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972
SHA512

22f87d8fe9ed341165baf6a37f18163f9a9be06af7e491b269ef3ebe2a192c764ce5c992c4270e8b82878b68a062073f5c239836231adadb12c28db0218af15b
SSDEEP

1536:onAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:oGs8cd8eXlYairZYqMddH13x

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2112	omsecor.exe
4388	omsecor.exe
812	omsecor.exe
372	omsecor.exe
3460	omsecor.exe
1680	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 2112 set thread context of 4388	2112	omsecor.exe	88
PID 812 set thread context of 372	812	omsecor.exe	108
PID 3460 set thread context of 1680	3460	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
212	2816	WerFault.exe	82
1040	2112	WerFault.exe	86
1464	812	WerFault.exe	107
4512	3460	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 2816 wrote to memory of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 2816 wrote to memory of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 2816 wrote to memory of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 2816 wrote to memory of 4372	2816	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	83
PID 4372 wrote to memory of 2112	4372	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	86
PID 4372 wrote to memory of 2112	4372	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	86
PID 4372 wrote to memory of 2112	4372	c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe	86
PID 2112 wrote to memory of 4388	2112	omsecor.exe	88
PID 2112 wrote to memory of 4388	2112	omsecor.exe	88
PID 2112 wrote to memory of 4388	2112	omsecor.exe	88
PID 2112 wrote to memory of 4388	2112	omsecor.exe	88
PID 2112 wrote to memory of 4388	2112	omsecor.exe	88
PID 4388 wrote to memory of 812	4388	omsecor.exe	107
PID 4388 wrote to memory of 812	4388	omsecor.exe	107
PID 4388 wrote to memory of 812	4388	omsecor.exe	107
PID 812 wrote to memory of 372	812	omsecor.exe	108
PID 812 wrote to memory of 372	812	omsecor.exe	108
PID 812 wrote to memory of 372	812	omsecor.exe	108
PID 812 wrote to memory of 372	812	omsecor.exe	108
PID 812 wrote to memory of 372	812	omsecor.exe	108
PID 372 wrote to memory of 3460	372	omsecor.exe	110
PID 372 wrote to memory of 3460	372	omsecor.exe	110
PID 372 wrote to memory of 3460	372	omsecor.exe	110
PID 3460 wrote to memory of 1680	3460	omsecor.exe	112
PID 3460 wrote to memory of 1680	3460	omsecor.exe	112
PID 3460 wrote to memory of 1680	3460	omsecor.exe	112
PID 3460 wrote to memory of 1680	3460	omsecor.exe	112
PID 3460 wrote to memory of 1680	3460	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
"C:\Users\Admin\AppData\Local\Temp\c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
  C:\Users\Admin\AppData\Local\Temp\c51daafbafe4a8521bf2cb7fbf4550ff2c7ba0227b37ffca1741e8617c5da972N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 256
        8⤵
        Program crash
        
        PID:4512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 292
        6⤵
        Program crash
        
        PID:1464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 300
      4⤵
      Program crash
      PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 288
  2⤵
  - Program crash
  PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2816 -ip 2816
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2112 -ip 2112
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 812 -ip 812
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3460 -ip 3460
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
825a2988c423dfbd3480015e32dd4a0a

SHA1
f1f0db61e746e0804b457e8791b059307f2f3f0d

SHA256
51332b52811ac532684c38bdf634c37dfa5dd3602fea928b13d8943de598f293

SHA512
06bfb70b9bccfdb88552b8eefcef236f8af78c54dc4507a78e4daf715a00ac99a117280d16cdeb1cd58e9b86ee438c4f484a20235922824a87dda35d3e1207ea

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
ef73bc5e3724450dba2b1d7fc513089f

SHA1
968d4d257e6f46cd69969592410f1a1c6ba6cfbe

SHA256
a44ecf5df3e463ca53d5904c98474aae9930edf8506d6ab722e74697463e1454

SHA512
5a32cf142a31d648b572079829fa72edc9aee977d08f13ed1517684b11f78e9fbc1def12883c13a4aa66392e6e43f008007d0c5d01dac75b780b88eff9f5ddf5

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
c43224a3fbc2b02f2f67d874306c2fd6

SHA1
8e8ed360958ac0b37390d1b1be27043d026049fc

SHA256
87814d7692a9ed59a24986819216d997f0771c8ae987202c134de50449674ef3

SHA512
4d425d8d10a136c927342f7e74240834575bda32b09b7454085a6ed2023cb17708c21c0209e8c8872c119e9c467e642c109938f87a28a3693426de31f7f6d2a8

Download Submit
memory/372-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/372-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/372-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/812-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/812-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1680-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1680-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1680-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2112-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3460-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3460-43-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4372-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4388-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download