neconyd | c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe
Size

64KB
MD5

aab4f2433346d23f9d0d8a935ca9f441
SHA1

e64bb91c75ad5a2ecd5c1e24466f22f1fce5f7b4
SHA256

c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76
SHA512

bac30460964dc6928d2fdb85cb53b5e6a755f580f077c85780bddf27e2404ed42ad96d660ac5b646266a97d95a3e8413f79f677dd2b0d0790a3d7891b94f6585
SSDEEP

768:sMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uAt:sbIvYvZEyFKF6N4yS+AQmZcl/5V

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3940	omsecor.exe
4972	omsecor.exe
4132	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3940	2060	c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe	83
PID 2060 wrote to memory of 3940	2060	c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe	83
PID 2060 wrote to memory of 3940	2060	c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe	83
PID 3940 wrote to memory of 4972	3940	omsecor.exe	100
PID 3940 wrote to memory of 4972	3940	omsecor.exe	100
PID 3940 wrote to memory of 4972	3940	omsecor.exe	100
PID 4972 wrote to memory of 4132	4972	omsecor.exe	101
PID 4972 wrote to memory of 4132	4972	omsecor.exe	101
PID 4972 wrote to memory of 4132	4972	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe
"C:\Users\Admin\AppData\Local\Temp\c966db3d63243bc569d4885d5e287cdd70b5424e56170809f1f1f1812d214f76.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
215db3a737d4beca6e2e382ce74ebfbb

SHA1
d4e733dadf6f7f8c896f08fa177f4521ca8332cd

SHA256
1c6bf0ab0d895175727dca77875ca357dda8864f42f730278cef5a3cfd5ab623

SHA512
033e471f6491783260ec0ace0beef6ffa9377bc3b8d6faf4a44a349570734397ffa78208ba95e7cb44e8d9e396c3c9a479d0b345638a085a28ad896e417eabe7

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
197239f2d8f9038ee9a61ab6b8f864dd

SHA1
9fa37f100036ed391f00c7723c07f018b9833ddd

SHA256
95f5c6b99ccf1dfa46d7dacd38f8728c1437a1f21a971f87d70f8ba921c9bc6d

SHA512
2affe30370e4690c7742a6527cb67651973af39d10b3f5d19a9f06e2bb0ac4b89a743818c641f170cd102f1f273019c41e2d392173469fc5d51c89ba3d66c81a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
6e493a639cdb0cd16e842cbc0838a48d

SHA1
12468be5b8716dedc2e797e158b8bcdd1d37892d

SHA256
1aa658bf49e5bf67b1d6bcd3b538d331922ab374d95c20934350c2fd69735c61

SHA512
56afc7921114bb78e92f7f48a8035277b70fd2f504bee1d63c07cd096881521a7c139baedd60c77712b0ca6588a9fe302f04306402cff2d66bcacf88b9b2074e

Download Submit