neconyd | 8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
Size

96KB
MD5

0b481018a8b1382484563291469c2db5
SHA1

6999c65cfe4d050752efd2b3e816904ecc054053
SHA256

8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596
SHA512

b9d26943a90264a840d63a58aebd96bbe555cade68d9241e12accd00798909cd5f0c6fb1b2d5be29a8b105ef103204571cd11443a1ce7a489d3f2011da18a228
SSDEEP

1536:5nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:5Gs8cd8eXlYairZYqMddH13B

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2900	omsecor.exe
3036	omsecor.exe
1760	omsecor.exe
2028	omsecor.exe
2284	omsecor.exe
1096	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
2900	omsecor.exe
3036	omsecor.exe
3036	omsecor.exe
2028	omsecor.exe
2028	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2900 set thread context of 3036	2900	omsecor.exe	32
PID 1760 set thread context of 2028	1760	omsecor.exe	36
PID 2284 set thread context of 1096	2284	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 2892 wrote to memory of 1988	2892	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	30
PID 1988 wrote to memory of 2900	1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	31
PID 1988 wrote to memory of 2900	1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	31
PID 1988 wrote to memory of 2900	1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	31
PID 1988 wrote to memory of 2900	1988	8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe	31
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 2900 wrote to memory of 3036	2900	omsecor.exe	32
PID 3036 wrote to memory of 1760	3036	omsecor.exe	35
PID 3036 wrote to memory of 1760	3036	omsecor.exe	35
PID 3036 wrote to memory of 1760	3036	omsecor.exe	35
PID 3036 wrote to memory of 1760	3036	omsecor.exe	35
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 1760 wrote to memory of 2028	1760	omsecor.exe	36
PID 2028 wrote to memory of 2284	2028	omsecor.exe	37
PID 2028 wrote to memory of 2284	2028	omsecor.exe	37
PID 2028 wrote to memory of 2284	2028	omsecor.exe	37
PID 2028 wrote to memory of 2284	2028	omsecor.exe	37
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38
PID 2284 wrote to memory of 1096	2284	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
"C:\Users\Admin\AppData\Local\Temp\8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
  C:\Users\Admin\AppData\Local\Temp\8cff840a5dfb15e27298ecb4d362b8f1b1f09a46e77cbb955fe4c332a21e3596.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1760
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
359fb3404db7c7d6bc19190796eb53c5

SHA1
f688eb00c7c7aba6d02c144c329f5529aeada4fd

SHA256
f6d91768154aa9430abba198ac853a9738e4feccf05032c4dd2f8810986a7918

SHA512
0e3e47781b8ff38b771942e7e8d82a7265b2b43091484e128ee37d06986843bed52ec6c3193ad556a03f7cb7030afdc03a380ffd3713323b964bdfdbc3444a32

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
a80f79d60ecc24fb1329d2bab84b142a

SHA1
d1a0549a17ce76f4172b482baf5d000b280a74fa

SHA256
dcee5c14d5e4a4850332a2d479f5a02e3e898fdf6aaed16fb1d3a87f2c6d35a6

SHA512
b6018772f28a087d94e2467d1f2465ab2b60e29f3a7ed6d753a6a0c9a0e9c3afc87107c550a13a99b5b35193e68501b3d68855c4448142fa1f1346d13e3939b2

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
1150a268e348bd534ccecc7075eafc63

SHA1
d33bd0e02fe4a70acc4d3a0a734c5d5b74b1fccd

SHA256
8a8395f6a926207db9c16bfdfb8fd88a6cc92e5ab9fa565e9ec22fab9fa30a04

SHA512
281ab5df62b0976e6ff968586de04369f6a2b9cb88e4365299a26f2e94b3729aaf98fc943972a6330c984bbbc097e3fb68fc1d2464154ca10311b534fa6549ba

Download Submit
memory/1096-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1760-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1760-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1988-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2284-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2284-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2892-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2892-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2900-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2900-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2900-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/3036-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3036-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3036-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3036-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3036-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download