neconyd | 83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5cc

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2025 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
Size

96KB
MD5

b41e920849e803b332e981b27ac59a30
SHA1

8d0e8f860f347f11823b0513a615992105ee6d07
SHA256

83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5cc
SHA512

b7a3184019d179cc42e88a22b5435470cc67adb279e37a4e34273dec2a67ed93b8928f7e1903ab02bec2a65f1c1c3926417d7c14a64da8849940b53065738ae8
SSDEEP

1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1692	omsecor.exe
4964	omsecor.exe
4628	omsecor.exe
4452	omsecor.exe
3112	omsecor.exe
712	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2216 set thread context of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 1692 set thread context of 4964	1692	omsecor.exe	86
PID 4628 set thread context of 4452	4628	omsecor.exe	100
PID 3112 set thread context of 712	3112	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2708	2216	WerFault.exe	81
4500	1692	WerFault.exe	85
4168	4628	WerFault.exe	99
1688	3112	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 2216 wrote to memory of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 2216 wrote to memory of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 2216 wrote to memory of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 2216 wrote to memory of 3136	2216	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	82
PID 3136 wrote to memory of 1692	3136	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	85
PID 3136 wrote to memory of 1692	3136	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	85
PID 3136 wrote to memory of 1692	3136	83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe	85
PID 1692 wrote to memory of 4964	1692	omsecor.exe	86
PID 1692 wrote to memory of 4964	1692	omsecor.exe	86
PID 1692 wrote to memory of 4964	1692	omsecor.exe	86
PID 1692 wrote to memory of 4964	1692	omsecor.exe	86
PID 1692 wrote to memory of 4964	1692	omsecor.exe	86
PID 4964 wrote to memory of 4628	4964	omsecor.exe	99
PID 4964 wrote to memory of 4628	4964	omsecor.exe	99
PID 4964 wrote to memory of 4628	4964	omsecor.exe	99
PID 4628 wrote to memory of 4452	4628	omsecor.exe	100
PID 4628 wrote to memory of 4452	4628	omsecor.exe	100
PID 4628 wrote to memory of 4452	4628	omsecor.exe	100
PID 4628 wrote to memory of 4452	4628	omsecor.exe	100
PID 4628 wrote to memory of 4452	4628	omsecor.exe	100
PID 4452 wrote to memory of 3112	4452	omsecor.exe	102
PID 4452 wrote to memory of 3112	4452	omsecor.exe	102
PID 4452 wrote to memory of 3112	4452	omsecor.exe	102
PID 3112 wrote to memory of 712	3112	omsecor.exe	104
PID 3112 wrote to memory of 712	3112	omsecor.exe	104
PID 3112 wrote to memory of 712	3112	omsecor.exe	104
PID 3112 wrote to memory of 712	3112	omsecor.exe	104
PID 3112 wrote to memory of 712	3112	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
"C:\Users\Admin\AppData\Local\Temp\83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
  C:\Users\Admin\AppData\Local\Temp\83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4628
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 256
        8⤵
        Program crash
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 292
        6⤵
        Program crash
        
        PID:4168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 288
      4⤵
      Program crash
      PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 300
  2⤵
  - Program crash
  PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2216 -ip 2216
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1692 -ip 1692
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4628 -ip 4628
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3112 -ip 3112
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
ebb6a6ea126b3e0576a8d82d69668513

SHA1
baafb30c51d361b92ee528ec1246603b4816a51c

SHA256
3e2dc227c3625d87abd29f740f539394a8836f0d1cc9450fe3e5fae083abf321

SHA512
925083d7c7973685469476c37cf0948979b82b96ff8447130c1e412468f71084c5c1732940e917ba307dafcd4ab52de7fffdac3d83f43e709c0bd6dbf3bc6260

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
87187790bb6d0f32b3374a02682a273f

SHA1
ae4f881cf61aec972accfc70fdc9094085c41493

SHA256
f0729945013661888667f795445e26df6a890240365c95c6630c2efa18bd8bcb

SHA512
fc5e7491434e0ee9a5817725a795b828986b2a06cf38ec0a32f9bb147cf1c801b0619850e574e6f102827ee94cf63471a629bb5a83760d2be7e2e0dcbab15f85

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
073948ad13709b11ab00545cf6bcbcb7

SHA1
cd420ac49d2676bba8c8cbdc6188994d3e080bd7

SHA256
8bd4e9741ce10628ecae5b4c103a4501fbfd39df8af9f99be9c34cda61ba80b3

SHA512
71ed6c5f014a40bea6c754862a3bd9ca313bf1424c75e43b049647d01dcd432efc0b24c4c8c68fd21518d10c39330b4824aa16d7979a1ad7721db13992cb42dd

Download Submit
memory/712-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/712-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/712-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1692-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2216-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2216-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3112-42-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3136-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4628-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4628-50-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4964-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4964-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download