neconyd | e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe
Size

33KB
MD5

b4a8013875297598e246b5cd6854d620
SHA1

854cd704e40d086dc99f220a62a56160fa6fbc1a
SHA256

e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542
SHA512

1ce62b33bdfa47ee17548a707ba1272c54468b3c2fa3cc898f94a97f34546e6161f5dd6423f84cfed72e056f0dd1c77727fc8025a471b6c1fd8975908a3491ce
SSDEEP

768:LfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7DJ:LfVRztyHo8QNHTk0qE5fslvN/956qw

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
4428	omsecor.exe
1152	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4428	2808	e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe	85
PID 2808 wrote to memory of 4428	2808	e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe	85
PID 2808 wrote to memory of 4428	2808	e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe	85
PID 4428 wrote to memory of 1152	4428	omsecor.exe	102
PID 4428 wrote to memory of 1152	4428	omsecor.exe	102
PID 4428 wrote to memory of 1152	4428	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe
"C:\Users\Admin\AppData\Local\Temp\e5ba58b7eaf078bef1dbd69871bdf44edf22cce79bf88997f90aac04974cf542N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
1246f7130a55fa56376369acd4ad4263

SHA1
92a08bb4cec064fbdde940142278750cbff60138

SHA256
8d64bc402439225eda18590eaa46e47386b8f3c71c1678d6fd21322b50d9dacc

SHA512
d60d0458258991dacc9eba803759de687beee21f2e8c9399156e168deb36932251a898748c5ae6d938062ccc766029824d21ab1caa2554e8b3073f72f4246e93

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
33KB

MD5
8bc1007351b6a6c5581771b7ed1187b3

SHA1
ea608cfe341ec2ec24af552f369cba4ea27e5a5b

SHA256
1850ad9be9451bfc604583fc5320a4a9fad0ba63aed262d80d58aed49f099630

SHA512
565debea67e1311cae0e882a47cecb9ddea2b55828b024fdb1a085139a72fc1c001e594e014b458125d580e74cc04f05d1daa904892cc978b10d88fec2cbafc5

Download Submit
memory/1152-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1152-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2808-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2808-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4428-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download