neconyd | 5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe
Size

80KB
MD5

431e044ebf05b222a2a8135ddc28cb70
SHA1

9aadb3aeae060ffc8f6bd055a4a06413a135eb4c
SHA256

5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490
SHA512

39958eaef07cad655fa0858af0abe45c1a6551aeae8ffda7e3879b40f9c324b1ec329227a6e810f069e83f98174f06f6ce89960ddb69c888fd70ec8605429ba4
SSDEEP

1536:Od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzB:WdseIOMEZEyFjEOFqTiQmOl/5xPvwN

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2084	omsecor.exe
4076	omsecor.exe
3988	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2084	1412	5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe	85
PID 1412 wrote to memory of 2084	1412	5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe	85
PID 1412 wrote to memory of 2084	1412	5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe	85
PID 2084 wrote to memory of 4076	2084	omsecor.exe	104
PID 2084 wrote to memory of 4076	2084	omsecor.exe	104
PID 2084 wrote to memory of 4076	2084	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe
"C:\Users\Admin\AppData\Local\Temp\5c3f04b162538d05c368c5c4f3123e4a914c64200b5fdb91e524ce5f977ae490N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4076
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
4865ee7de1deab80ee74a23d065cb541

SHA1
83a17afa28723454fa5abfba17d8db9e7dee1892

SHA256
9ea17b04acbf67d7bcb5d9b58d21093e0d4a30a838fc17f14085a44c3944f0a2

SHA512
8658141d1d117575cf5a666804aee8496586b01d69183f78909d22317dc59d6b832e425cab47feef22d34f1acaba6adcbd55b229afc7a2f144c25b18323e4b90

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
7100d061eb35f2d8b7b12688b68669ea

SHA1
a25b5864bcd620fc8f1cd530f5fbc40475ba6a23

SHA256
99a45f4ff105e27a7f60db4820a8842d9e3781e24a0169563d452553ce8b249d

SHA512
fbb68e24817e3e1b6ef538a84b86418dafcad3597b8d344a4a5beb3ccbd60129391f68daf3281cc96d6f770ff9b975d0ba35ee31f7102edbffe9617b6f64982c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
b1fca45c11da3f4701254407eff85ada

SHA1
726bafcfbb3ad4b98b2eda2d7eaa0e7977806f9e

SHA256
f196894293616a63a7a04a650a878c952a15b269e966372bf9d302ff2682c0e7

SHA512
8fd4642f5a6a38de04f8241b1883c6f4ad1bd43b02ee54a382d1e466126ba5fc47a13cb8a0ee03284b307622667abc8534bb64416b04ae4566fea22963e674ca

Download Submit