neconyd | 2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2025 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe
Size

72KB
MD5

c70ba8999aebb0e1aff0753892cf6d2f
SHA1

f278750c11b8c996ebad4863300f3fe9c266339c
SHA256

2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d
SHA512

609c0e5ca36102e3effe8f9108af4afd2ded4713a64bf8750da546f97c552456aeba268fae6575b153499acbd098f41586b618ed9f14b03b7804fcce52be37c9
SSDEEP

1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211X:ddseIOMEZEyFjEOFqTiQm5l/5211X

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1952	omsecor.exe
3500	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1952	4088	2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe	82
PID 4088 wrote to memory of 1952	4088	2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe	82
PID 4088 wrote to memory of 1952	4088	2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe	82
PID 1952 wrote to memory of 3500	1952	omsecor.exe	92
PID 1952 wrote to memory of 3500	1952	omsecor.exe	92
PID 1952 wrote to memory of 3500	1952	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe
"C:\Users\Admin\AppData\Local\Temp\2d7fdb3e9cafb9ead3620b111f374d109a587ac2e9d03392cf79b248bbfc6b5d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
748b2874c8bbfd68cc45ba2a99ddcc3d

SHA1
f72370d44b14dbeb1f575b4f5cdb0682ded9ce23

SHA256
ed8dc9935e85e7886467be753e47c17d289217a217530887789c02167824a5e8

SHA512
6f291dd723ce546334c030ae5e4a1e87338016dc8ab6f3931ea6da62ce9e95c2e3cd4416c6a53f6303d46236b90d92d7d5585054336d1e2aae32d1a49b9550de

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
d41192134e192fb2a711ecc77ec4233d

SHA1
f5ced6a6d99f289c327d85c22cfcbc5ba4807823

SHA256
b335d0fbc6d1935ea75c074ae23c05901de2f79c4021351e186de9ff151cc9f4

SHA512
3ee2f30d82442db72901aee0328ec623cbceeeb07ae3a16cb05ce5f815209303aa38a153263f621e38d818e8e5276288032a41ab9575fa7d648ee72f634eaea9

Download Submit