neconyd | caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
Size

96KB
MD5

708cabe5570c1688b17002a97837de90
SHA1

eb4a4b14b32128274e404966763f7b49d24f6b4a
SHA256

caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680
SHA512

007241ba219fe352531d781c51599bf865087e1a83a84c731f7afced2136bc991522801132be724484a7eb6c044c90bbf1270d4b37241cb05e142a20a96678d6
SSDEEP

1536:3nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxu:3Gs8cd8eXlYairZYqMddH13u

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4760	omsecor.exe
4740	omsecor.exe
2316	omsecor.exe
500	omsecor.exe
1128	omsecor.exe
4400	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 4760 set thread context of 4740	4760	omsecor.exe	88
PID 2316 set thread context of 500	2316	omsecor.exe	108
PID 1128 set thread context of 4400	1128	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3260	2808	WerFault.exe	82
2496	4760	WerFault.exe	86
4500	2316	WerFault.exe	107
952	1128	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 2808 wrote to memory of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 2808 wrote to memory of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 2808 wrote to memory of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 2808 wrote to memory of 4428	2808	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	83
PID 4428 wrote to memory of 4760	4428	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	86
PID 4428 wrote to memory of 4760	4428	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	86
PID 4428 wrote to memory of 4760	4428	caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe	86
PID 4760 wrote to memory of 4740	4760	omsecor.exe	88
PID 4760 wrote to memory of 4740	4760	omsecor.exe	88
PID 4760 wrote to memory of 4740	4760	omsecor.exe	88
PID 4760 wrote to memory of 4740	4760	omsecor.exe	88
PID 4760 wrote to memory of 4740	4760	omsecor.exe	88
PID 4740 wrote to memory of 2316	4740	omsecor.exe	107
PID 4740 wrote to memory of 2316	4740	omsecor.exe	107
PID 4740 wrote to memory of 2316	4740	omsecor.exe	107
PID 2316 wrote to memory of 500	2316	omsecor.exe	108
PID 2316 wrote to memory of 500	2316	omsecor.exe	108
PID 2316 wrote to memory of 500	2316	omsecor.exe	108
PID 2316 wrote to memory of 500	2316	omsecor.exe	108
PID 2316 wrote to memory of 500	2316	omsecor.exe	108
PID 500 wrote to memory of 1128	500	omsecor.exe	110
PID 500 wrote to memory of 1128	500	omsecor.exe	110
PID 500 wrote to memory of 1128	500	omsecor.exe	110
PID 1128 wrote to memory of 4400	1128	omsecor.exe	112
PID 1128 wrote to memory of 4400	1128	omsecor.exe	112
PID 1128 wrote to memory of 4400	1128	omsecor.exe	112
PID 1128 wrote to memory of 4400	1128	omsecor.exe	112
PID 1128 wrote to memory of 4400	1128	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
"C:\Users\Admin\AppData\Local\Temp\caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
  C:\Users\Admin\AppData\Local\Temp\caa395205da0af9e4626100ad4e6487cd545b013ca431286c4031083064f3680N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2316
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:500
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 256
        8⤵
        Program crash
        
        PID:952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 292
        6⤵
        Program crash
        
        PID:4500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 300
      4⤵
      Program crash
      PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 292
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4760 -ip 4760
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2316 -ip 2316
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1128 -ip 1128
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
e1607f2065067150cdf498e38aed3f04

SHA1
1601c0a3fe6b81d5136ad467ddfa1c270bcedcae

SHA256
802de69e8909bce55549ff552dc34552849f268be83c4425c39be82d4600763c

SHA512
38e9b9b5e6c3b2cda53869fce89dd093fca3a7e0e4bbb87c31eea48b24138913d80958cd0d780506195ec43db0e9db2718fed46719d7feba1524265e388f22d4

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f5ee8d0e72495812d54b1fc77d1a379e

SHA1
3969628bbec63b9906d2a52dfde90cd9be09a840

SHA256
c783c1f1900f45f0db262b44e3fc4dfda92fa9bb65bdabdc6b0c5b9b8859ebb7

SHA512
26544adeef52ac77ae89567a1a2483eaf7cb7ffe748628ecda796cfa98f73eea90ab5487521a08932c9535f1030c334e0c3753d813dcc5bfdef44d4798d79b7c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3b4e57dfcd779f49dcd7e65ea67ed4b7

SHA1
65be6fc882108cf3443f5dc86ff3fcfae047ecda

SHA256
a07437a445eeb40ace64d75f7953ef1e1505e0455fe1aa8bf3401e8446c7d779

SHA512
f3767b0ba5d72ea4ce6ef1fcceacf9d52e1171e3c67fe591a3fdc1767e06467d18d9f69ab92dc263637302010857f887ea6bf7e30c9ef6352c6640c1e7ab98a7

Download Submit
memory/500-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/500-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/500-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1128-44-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2316-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2316-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2808-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2808-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4400-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4740-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4760-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4760-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download