neconyd | 07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2025 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe
Size

65KB
MD5

411cf69a0de4b66bf6aa9c605f7d8cf4
SHA1

e79c594d7ac424a9f5a6907ecf1ebe9b9fdff824
SHA256

07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54
SHA512

246d990120c444d47652144bc4bc14dac27b68c3a0bb1c4d6bf61ca6ebbb5ed00f02d7e628c950c2aa384525267af4845c11b27b88c3356aa08f5b4f63da60dd
SSDEEP

1536:7d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:LdseIO+EZEyFjEOFqTiQmRHz

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1920	omsecor.exe
4592	omsecor.exe
1068	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1920	5020	07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe	83
PID 5020 wrote to memory of 1920	5020	07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe	83
PID 5020 wrote to memory of 1920	5020	07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe	83
PID 1920 wrote to memory of 4592	1920	omsecor.exe	100
PID 1920 wrote to memory of 4592	1920	omsecor.exe	100
PID 1920 wrote to memory of 4592	1920	omsecor.exe	100
PID 4592 wrote to memory of 1068	4592	omsecor.exe	101
PID 4592 wrote to memory of 1068	4592	omsecor.exe	101
PID 4592 wrote to memory of 1068	4592	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe
"C:\Users\Admin\AppData\Local\Temp\07ee6d797fcb3ea339d26ea2a429ccd810a26c627d564b3d6e6743dea230ea54.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
58adebe9b9f49a65919ee51516ccb8b2

SHA1
78542705bcb6a69610b767fd9fad10d6969609db

SHA256
ee9ae62e4af18431179e18d1822c0e9bd3ecd5e55627801199db8070c68a537a

SHA512
6918f786636a3266f667daeb744d199e2d5daf425fe05d00af9605181ad8da4c50082008556a0705c125d0a1ccbda43491ef04ca9868670fe5e389ecebd124d2

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
0793bdda5123c04271af2c50aa71ce66

SHA1
7a2d9296ed4da6448816cd9904c932216e63deb6

SHA256
1207f8a9fab6cbe70fa08601a663b0b5ea293459a2e0e9e01f38c0d9ee6e95cb

SHA512
9746afda014f5747561d08623d4807b540550321a38fffa173fa22458ca9028d81cd2f9e85a73743f896465c9a909904be68d6c147a374ca5026fd393d737162

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
3be017dc36f2219228fd23b80a57dbca

SHA1
9d9e1c3f7e3e48a78027c8863259b51a6e9ef33d

SHA256
333ede4a2a4312091e3cd23496bcb7b64972c2f16de2cddad413aeb8a40d4845

SHA512
471fbab78f7c612570cf47878880056bdf8b6fb41a04c6032c64c05701e7c14f8b58ca6fb96db550d3cf1b30a213b623374189da13f56b084c0e52c2de7fef38

Download Submit
memory/1068-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1920-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1920-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1920-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4592-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4592-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5020-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5020-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download