neconyd | a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
Size

92KB
MD5

4f255b55b9ec24e331ad774099e59630
SHA1

1eb3763c3f164c073bb320646f5b6a59616b6fec
SHA256

a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117
SHA512

8ece9d7cf3c022883f9cf8c94b26cd00bda9a0065aea6539b0a9e9c25470f5de8d4f069f9fd57c142d1b29c762345c221f2c25d3186dbd8890e15c8e968d59d4
SSDEEP

1536:Kd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5d:KdseIOyEZEyFjEOFqTiQm5l/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
3820	omsecor.exe
1576	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3820	3180	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	85
PID 3180 wrote to memory of 3820	3180	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	85
PID 3180 wrote to memory of 3820	3180	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	85
PID 3820 wrote to memory of 1576	3820	omsecor.exe	103
PID 3820 wrote to memory of 1576	3820	omsecor.exe	103
PID 3820 wrote to memory of 1576	3820	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
"C:\Users\Admin\AppData\Local\Temp\a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
7fe023bd6a18199fb4e09b13388c4bec

SHA1
26119cfe8818bb197f398025399116ca00ce2ea0

SHA256
d1f5c66713ca248412036eeb18c1deda030d78772975bcfd582f33fd4b0b7c1a

SHA512
fa092adad5a9ac004dbd5c8749622e4d7d237352b9d46650588731ecdc53d179f45e02fd2285718f1eae5a173d7f22dc2379ceda8177d86422bae34e142c8bfa

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
92KB

MD5
7ef6d373d654dcc6bd9f4d45a63faea1

SHA1
6634fbcbfbee5ea0a37a825fa4ee3097278f87e2

SHA256
5e85f07fbfaf35b6434b4ed6d07fe99ec1cfc5fcdf3e17df2702e0beca19017f

SHA512
f47120b7265bc584d69ae7e76d6ed541a7ac507ada59159fa5773eacda37e81df2b4883ca65fb94e2a4a314f3b3bbf192e51130d7d34baad1df52f53ce67df9a

Download Submit
memory/1576-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1576-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3180-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3180-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3820-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3820-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3820-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download