neconyd | c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f

Analysis

max time kernel
115s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
Size

96KB
MD5

31259142051fb5b341551ad51cae55c9
SHA1

d04b24a96b510995a7d7f6f665bf9eef5a480829
SHA256

c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f
SHA512

1ebfccf6797b9520bc07b30ea35935cd33770559cd9c9d78da6081988c002fad1e7587f45192f9a6853b9447a0b2e674a33f8ad1f411400efc820ff3415ccfbe
SSDEEP

1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:BGs8cd8eXlYairZYqMddH13B

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2880	omsecor.exe
2436	omsecor.exe
2812	omsecor.exe
2400	omsecor.exe
1372	omsecor.exe
1720	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
2880	omsecor.exe
2436	omsecor.exe
2436	omsecor.exe
2400	omsecor.exe
2400	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2880 set thread context of 2436	2880	omsecor.exe	30
PID 2812 set thread context of 2400	2812	omsecor.exe	33
PID 1372 set thread context of 1720	1372	omsecor.exe	35

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2340 wrote to memory of 2264	2340	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	28
PID 2264 wrote to memory of 2880	2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	29
PID 2264 wrote to memory of 2880	2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	29
PID 2264 wrote to memory of 2880	2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	29
PID 2264 wrote to memory of 2880	2264	c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe	29
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2880 wrote to memory of 2436	2880	omsecor.exe	30
PID 2436 wrote to memory of 2812	2436	omsecor.exe	32
PID 2436 wrote to memory of 2812	2436	omsecor.exe	32
PID 2436 wrote to memory of 2812	2436	omsecor.exe	32
PID 2436 wrote to memory of 2812	2436	omsecor.exe	32
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2812 wrote to memory of 2400	2812	omsecor.exe	33
PID 2400 wrote to memory of 1372	2400	omsecor.exe	34
PID 2400 wrote to memory of 1372	2400	omsecor.exe	34
PID 2400 wrote to memory of 1372	2400	omsecor.exe	34
PID 2400 wrote to memory of 1372	2400	omsecor.exe	34
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35
PID 1372 wrote to memory of 1720	1372	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
"C:\Users\Admin\AppData\Local\Temp\c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
  C:\Users\Admin\AppData\Local\Temp\c2bb4cd1253f1c220eddd298ddf39c376c6902401643b0f42eb09b5432fc134f.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
1394437ad8788e301cf61e016eb630ca

SHA1
6fb4d8f881095f187d85fcebeb9adc44f465cf43

SHA256
f103bf3214dc49e03a62c5f5505e434a24589e506c6a67662cee51755c771842

SHA512
05355783c0c3c113871df10741c420d890d857bd691634666cdc2e2a95e2bd2cc35ef94a50489a8c66e667b434006fa4086c0d540bd8a978c07ec692dfc72612

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
062dbbecbb5179b80ac26cf0affe6b06

SHA1
22d705f207268aed8b9bf3dc62fbbf11a5d7b2bc

SHA256
e944cea2bdf416dc002f93ea773c19a0a075b7b3fb99e6f2578bc62b8f95db0c

SHA512
f6795efcb8250bde629b5e9e3303f38cf59cdaa0b153fd03688a40feb97175a5b1069b23fc644b9e0bb64b603f90a100cc434c44f9c252a82de24b22089d5440

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
8762c2600b8fce93baad3f96672ffc48

SHA1
3789d2e200d316ff1c2254b661417ee664b8eed4

SHA256
3f80b15a761215c2d3acc2c952fa2b5563329a2b39b1621d94b756fda57dc235

SHA512
8632119b0c44248c9d7da1e33dec1e7c5c473a38636db0149d910cb9d6aab2b9c6ab256803d8c9bfeb333dd13d616777e1409bcb9951856fedc7712c4f512c0f

Download Submit
memory/1372-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1372-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1720-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2264-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2264-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2264-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2264-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2264-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2340-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2340-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2436-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-47-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/2436-57-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/2436-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-89-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/2812-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2880-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2880-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2880-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download