neconyd | 15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
Size

96KB
MD5

a5ccc22c1115e6263a3a874ed5311a57
SHA1

c130a998884c6effd4c5c5cc7c9633cbab5765e2
SHA256

15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f
SHA512

370db693b42005be33173b597979274ccacd4c29c73dc1cef65a9bb7c1c9472d752e34af28eff15d7d7fd6e0be7609fe16f6ebc2f8a6d1dcea472c0fface647d
SSDEEP

1536:AnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxD:AGs8cd8eXlYairZYqMddH13D

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4928	omsecor.exe
5096	omsecor.exe
1956	omsecor.exe
4880	omsecor.exe
4400	omsecor.exe
3952	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 4928 set thread context of 5096	4928	omsecor.exe	87
PID 1956 set thread context of 4880	1956	omsecor.exe	100
PID 4400 set thread context of 3952	4400	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3956	1612	WerFault.exe	81
5032	4928	WerFault.exe	85
4692	1956	WerFault.exe	99
408	4400	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 1612 wrote to memory of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 1612 wrote to memory of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 1612 wrote to memory of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 1612 wrote to memory of 2316	1612	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	82
PID 2316 wrote to memory of 4928	2316	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	85
PID 2316 wrote to memory of 4928	2316	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	85
PID 2316 wrote to memory of 4928	2316	15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe	85
PID 4928 wrote to memory of 5096	4928	omsecor.exe	87
PID 4928 wrote to memory of 5096	4928	omsecor.exe	87
PID 4928 wrote to memory of 5096	4928	omsecor.exe	87
PID 4928 wrote to memory of 5096	4928	omsecor.exe	87
PID 4928 wrote to memory of 5096	4928	omsecor.exe	87
PID 5096 wrote to memory of 1956	5096	omsecor.exe	99
PID 5096 wrote to memory of 1956	5096	omsecor.exe	99
PID 5096 wrote to memory of 1956	5096	omsecor.exe	99
PID 1956 wrote to memory of 4880	1956	omsecor.exe	100
PID 1956 wrote to memory of 4880	1956	omsecor.exe	100
PID 1956 wrote to memory of 4880	1956	omsecor.exe	100
PID 1956 wrote to memory of 4880	1956	omsecor.exe	100
PID 1956 wrote to memory of 4880	1956	omsecor.exe	100
PID 4880 wrote to memory of 4400	4880	omsecor.exe	102
PID 4880 wrote to memory of 4400	4880	omsecor.exe	102
PID 4880 wrote to memory of 4400	4880	omsecor.exe	102
PID 4400 wrote to memory of 3952	4400	omsecor.exe	104
PID 4400 wrote to memory of 3952	4400	omsecor.exe	104
PID 4400 wrote to memory of 3952	4400	omsecor.exe	104
PID 4400 wrote to memory of 3952	4400	omsecor.exe	104
PID 4400 wrote to memory of 3952	4400	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
"C:\Users\Admin\AppData\Local\Temp\15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
  C:\Users\Admin\AppData\Local\Temp\15519e0bb412420966d63682601f19fac4c2f463e8418ad4491e904822c46a0f.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 256
        8⤵
        Program crash
        
        PID:408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 292
        6⤵
        Program crash
        
        PID:4692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 288
      4⤵
      Program crash
      PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 292
  2⤵
  - Program crash
  PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4928 -ip 4928
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1956 -ip 1956
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4400 -ip 4400
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
be83e80605e207c27525c7cafc1f063e

SHA1
53b8799c8f79b628d25503ea81690c6c7650e884

SHA256
c96d705a0a6be387e5efdabba9a647a076eecd81ff85c6b3b0b5826c49f27950

SHA512
24bcf2faca9e816c0a286da141607b5ce4786440c788bda57e866ce016d2ded7998a4c1151026a327b37f817ccb8d0a108a6b00b4a850b91f970e00e2955a0db

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
ae0c0646a62dab201253cfac72faf8f2

SHA1
fa696a12ab61d6d0c61bf9f6c3fa61eed3eb2d88

SHA256
09aa2cad66860837e48a094ad50eea329488c4f70cc36141bbd850d99115cbd8

SHA512
17441b15861c77952922e332ec2202a3f6f234af30420bb587d9819ed08ee52036306b4e2e2e8242502a86df75b31f927d02bec90f8ab4fc9c44799ff85a6fb2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3a853663ff91433f4cc3f432bdd68b5e

SHA1
5619b28afd35ace1bbe81adac36540d876fac8f3

SHA256
b53b198309555adc9eef5bf8b5d99f0f35aecb47740d416f05e8a94a16383325

SHA512
dd05fa079244ca6fc4d7be216a42f67685b08d904d70c47daf16b7bc902b4afce06c860dc6aacebb90517df456dbd43ce5399e3dc7bf0d14ceb3106958a228c2

Download Submit
memory/1612-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1612-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1956-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1956-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2316-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2316-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2316-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2316-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3952-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3952-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3952-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4400-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4880-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4880-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4880-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4928-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5096-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5096-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download