neconyd | 4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
Size

96KB
MD5

e2939dea0aa94c39dbb06764957afc50
SHA1

1477cd7cd57d035e2dcd857ebcd89d5b622d4a5f
SHA256

4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8
SHA512

da3b7e541fc7fbf3a6c468eb0b8b8faf999a9247daadc28746941b7d979d3868ccd011c9794f5bcd858f271e9be53b37f8bdb4d1c84f644a38218cf0593e4eeb
SSDEEP

1536:CnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:CGs8cd8eXlYairZYqMddH13b

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2480	omsecor.exe
2608	omsecor.exe
696	omsecor.exe
2332	omsecor.exe
4276	omsecor.exe
1596	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 2480 set thread context of 2608	2480	omsecor.exe	88
PID 696 set thread context of 2332	696	omsecor.exe	109
PID 4276 set thread context of 1596	4276	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4316	532	WerFault.exe	82
2872	2480	WerFault.exe	86
3468	696	WerFault.exe	108
4140	4276	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 532 wrote to memory of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 532 wrote to memory of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 532 wrote to memory of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 532 wrote to memory of 2428	532	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	83
PID 2428 wrote to memory of 2480	2428	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	86
PID 2428 wrote to memory of 2480	2428	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	86
PID 2428 wrote to memory of 2480	2428	4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe	86
PID 2480 wrote to memory of 2608	2480	omsecor.exe	88
PID 2480 wrote to memory of 2608	2480	omsecor.exe	88
PID 2480 wrote to memory of 2608	2480	omsecor.exe	88
PID 2480 wrote to memory of 2608	2480	omsecor.exe	88
PID 2480 wrote to memory of 2608	2480	omsecor.exe	88
PID 2608 wrote to memory of 696	2608	omsecor.exe	108
PID 2608 wrote to memory of 696	2608	omsecor.exe	108
PID 2608 wrote to memory of 696	2608	omsecor.exe	108
PID 696 wrote to memory of 2332	696	omsecor.exe	109
PID 696 wrote to memory of 2332	696	omsecor.exe	109
PID 696 wrote to memory of 2332	696	omsecor.exe	109
PID 696 wrote to memory of 2332	696	omsecor.exe	109
PID 696 wrote to memory of 2332	696	omsecor.exe	109
PID 2332 wrote to memory of 4276	2332	omsecor.exe	111
PID 2332 wrote to memory of 4276	2332	omsecor.exe	111
PID 2332 wrote to memory of 4276	2332	omsecor.exe	111
PID 4276 wrote to memory of 1596	4276	omsecor.exe	113
PID 4276 wrote to memory of 1596	4276	omsecor.exe	113
PID 4276 wrote to memory of 1596	4276	omsecor.exe	113
PID 4276 wrote to memory of 1596	4276	omsecor.exe	113
PID 4276 wrote to memory of 1596	4276	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
"C:\Users\Admin\AppData\Local\Temp\4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
  C:\Users\Admin\AppData\Local\Temp\4ce74e17a4e2520215895f43013ead5e175d7c9b4cced4a049b138ffeee76ae8.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:696
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 256
        8⤵
        Program crash
        
        PID:4140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 292
        6⤵
        Program crash
        
        PID:3468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 300
      4⤵
      Program crash
      PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 288
  2⤵
  - Program crash
  PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 532 -ip 532
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2480 -ip 2480
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 696 -ip 696
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4276 -ip 4276
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
4001acb6a076c88f6212d2fb5c5c727a

SHA1
a658e914c8bd1745486ffc57e197cbd420146167

SHA256
8cb32c4f1fb65dd958fac0927c585819bfd74d6f85678c26cb719bac481e6795

SHA512
44d367f4eebc3a5b0f4276d7a67fd96f91c2847406154bd728830373ee0b37fc97511fbc9deed80bf0c834bc93cdb415216ac9cf9433b8683f8b6d34ed7db85d

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
77abbac0c65ccd840798de8de84260bd

SHA1
e7bd8af7b556e8af410b3b795324cabad3325266

SHA256
e5a76af78f10e56ff41a5033c5cec3073ff01542fca1ef2c4957e2f45ffad10b

SHA512
d0b14368492c6149b63e2cd996fbaa02363286aa1adfd6064b095431f4c987abf0f74a06ab88a8c7b71299be3fdb6103de3f9dc12f7abb99fc517098f83ccf44

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
47d13d86abc048ec115015d89d118d7f

SHA1
9a73b2a4e27c263c337865cf7b221e878a42c404

SHA256
a76aef08d50eadb486ce11be29b66b536d669496795b976e42d3e51a0aecb7e7

SHA512
665a05ffcba63329376ab1389ea3c46606aff8b6b454555da88eb81d090f94c42e2052335b5c914177336925deef594a52714b3a99fb6c3dc44bc71d9d7fba2b

Download Submit
memory/532-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/532-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/696-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/696-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1596-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1596-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1596-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2428-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2428-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2428-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2428-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2480-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2480-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2608-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2608-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4276-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download