neconyd | d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
Size

61KB
MD5

06e5bf97166620194efbcad564c87bda
SHA1

7933f8333bb7c6e0b7c4a72ec3202f89b76cf594
SHA256

d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6
SHA512

46234f48c7967baa43536c4eec4ced38db191dc4346526d963b63895fdefa6a124c0a9e5f16ba43c4aa0638e08b6cd5106f4dc007a32f8ece24e5118f76533b3
SSDEEP

1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ1l/5:VdseIOMEZEyFjEOFqTiQmXl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2084	omsecor.exe
4664	omsecor.exe
2304	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2084	1412	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	85
PID 1412 wrote to memory of 2084	1412	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	85
PID 1412 wrote to memory of 2084	1412	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	85
PID 2084 wrote to memory of 4664	2084	omsecor.exe	102
PID 2084 wrote to memory of 4664	2084	omsecor.exe	102
PID 2084 wrote to memory of 4664	2084	omsecor.exe	102
PID 4664 wrote to memory of 2304	4664	omsecor.exe	103
PID 4664 wrote to memory of 2304	4664	omsecor.exe	103
PID 4664 wrote to memory of 2304	4664	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
"C:\Users\Admin\AppData\Local\Temp\d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
ce68bf5b75fc33bd23633d8bc4f39a01

SHA1
9f92b370529c60738f8b8ce8c3971cc5ceb0bdce

SHA256
eb92d51efc7e60d6176de4fbef013c1e8d52ef84fc0fb94066bfb8c8b927277d

SHA512
7b63a12f79112b76b7beb795d2dfac680997675383334f97f8ce09ae7412e62444b080b1cc6c36365cf31b54b7596aea975cd9a8f870264b56d105b5fbccdbcf

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
e61da40fcd0b16e1ef5ed6e3d7fe7407

SHA1
68c3c6f30c490c7f08617cfc160cd403c737d9ad

SHA256
d1aa391442611112fe6627abddb280ec27ad2ba2b7c6a263f6ab6da4fc50b20e

SHA512
a6b21355f2c6feb9758cd0b5a1f596a8709765925a79d413a4757759b983862569c613a0e9cdd4306255d7ab43557e6428c502808f9078aab6e2cd26955dd96a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
a289b5f5582e6698d2c9f79ae3648e61

SHA1
edcf25eae96e602bfcc50fc164a4474842f467f4

SHA256
11d22453b9958edc06a1628228d11ed87f477ebb83962005bb9d2fbc6d4dfc6a

SHA512
0feff96101fd67682d095b228eaffec3dbf373c182a72036c80a57d06caef25de9fa9f28c0ecfa0b19525b47439f74e0216e0d865581ca17c991cc94db082976

Download Submit