neconyd | f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
Size

96KB
MD5

0499bbe9425e490f9b4aee29884c0fc0
SHA1

3e8a1933871c4daca8a23fa840fb77a8da5b53ca
SHA256

f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25
SHA512

1383d194b990c7e0b4ed6452361731e9d412e2c809805a2ffae9c53b71ce72b9cf322e0cffebeff34e06bcf3d50bb7384d6e516c11fe13d8ed389791d9003c13
SSDEEP

1536:LnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:LGs8cd8eXlYairZYqMddH13r

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2736	omsecor.exe
2784	omsecor.exe
2716	omsecor.exe
1880	omsecor.exe
1780	omsecor.exe
1996	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
2736	omsecor.exe
2784	omsecor.exe
2784	omsecor.exe
1880	omsecor.exe
1880	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2736 set thread context of 2784	2736	omsecor.exe	32
PID 2716 set thread context of 1880	2716	omsecor.exe	36
PID 1780 set thread context of 1996	1780	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2892 wrote to memory of 2772	2892	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	30
PID 2772 wrote to memory of 2736	2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	31
PID 2772 wrote to memory of 2736	2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	31
PID 2772 wrote to memory of 2736	2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	31
PID 2772 wrote to memory of 2736	2772	f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe	31
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2736 wrote to memory of 2784	2736	omsecor.exe	32
PID 2784 wrote to memory of 2716	2784	omsecor.exe	35
PID 2784 wrote to memory of 2716	2784	omsecor.exe	35
PID 2784 wrote to memory of 2716	2784	omsecor.exe	35
PID 2784 wrote to memory of 2716	2784	omsecor.exe	35
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 2716 wrote to memory of 1880	2716	omsecor.exe	36
PID 1880 wrote to memory of 1780	1880	omsecor.exe	37
PID 1880 wrote to memory of 1780	1880	omsecor.exe	37
PID 1880 wrote to memory of 1780	1880	omsecor.exe	37
PID 1880 wrote to memory of 1780	1880	omsecor.exe	37
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38
PID 1780 wrote to memory of 1996	1780	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
"C:\Users\Admin\AppData\Local\Temp\f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
  C:\Users\Admin\AppData\Local\Temp\f1c59ffd2332779dd6b34986893a03a55d1db62dddb7d0e0ec00e3237b843b25N.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
7952f500bf172e958c31c7a5be069646

SHA1
85d37a87273693327acee0484ad275b15ce11c3b

SHA256
c931b1ca918decb8281e3efe0ed79afc97d61948abbdf7ea4498b86e3d1be57f

SHA512
dbe5e2b5ff68830768b4c0d4bb48327c87f20a4f0c168b72c708b39463aba217c9daee3862cfcd8fe27a7c4591c5cede504bf693dcaecfb013839d3d36827aef

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
ee6a6dd21a125cdd59a7d3750df25fc1

SHA1
051ced6503e4a0433150c2da4145e6c1cd549c1e

SHA256
ff52616cd4cc593b8b9674b8205cd3b488b1a8f5e5757314f4c8f71b320ba472

SHA512
98129ff3a57da6292f7032a7af098970c15fa5ced65d0ff34afa74d1f61732adc9609c529ddecc62a7b7c38d8d829b6d423113d9f0ffb6009d019fae9fbd79b6

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
cad89c61d79cff080095d7f2bc07042c

SHA1
8d41ddedeb93f1c6681e4a57564070db9c6db628

SHA256
e1721befa6b7b6e896e7904d3052befd1562d1e15015030fce3c4c9e6c56f1e0

SHA512
bc14f019811e3d29a58c6f563085555815214b02d13c85b6ca46194274e7b140550cf4c689b68220ed80c4e13b6a4d8f2261c81e53884449a3d74f1e1397c1b0

Download Submit
memory/1780-86-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-78-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1880-88-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/1996-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2716-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2736-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2736-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2736-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2772-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2772-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2772-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2772-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-48-0x0000000000290000-0x00000000002B3000-memory.dmp

Filesize
140KB

Download
memory/2784-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2892-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download