neconyd | a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe
Size

96KB
MD5

787bb733bd65ffabe55a3153d1b58db4
SHA1

1e56f1a4108108dd57052ce04ac92e35056bd450
SHA256

a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80
SHA512

3e88d679b1c97d6b6a3fce946aaa603e3139af26975dd9416a8c7e5b3d2965472d67b31ac9ec65ea5c449621b02b4dd117aa45011220fe91d3b1b64ee2dbef1f
SSDEEP

1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:tGs8cd8eXlYairZYqMddH137

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4356	omsecor.exe
2192	omsecor.exe
3768	omsecor.exe
4384	omsecor.exe
2956	omsecor.exe
832	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 4356 set thread context of 2192	4356	omsecor.exe	88
PID 3768 set thread context of 4384	3768	omsecor.exe	96
PID 2956 set thread context of 832	2956	omsecor.exe	100

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1108	2148	WerFault.exe	82
3124	4356	WerFault.exe	86
2072	3768	WerFault.exe	95
612	2956	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 2148 wrote to memory of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 2148 wrote to memory of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 2148 wrote to memory of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 2148 wrote to memory of 2708	2148	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	83
PID 2708 wrote to memory of 4356	2708	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	86
PID 2708 wrote to memory of 4356	2708	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	86
PID 2708 wrote to memory of 4356	2708	a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe	86
PID 4356 wrote to memory of 2192	4356	omsecor.exe	88
PID 4356 wrote to memory of 2192	4356	omsecor.exe	88
PID 4356 wrote to memory of 2192	4356	omsecor.exe	88
PID 4356 wrote to memory of 2192	4356	omsecor.exe	88
PID 4356 wrote to memory of 2192	4356	omsecor.exe	88
PID 2192 wrote to memory of 3768	2192	omsecor.exe	95
PID 2192 wrote to memory of 3768	2192	omsecor.exe	95
PID 2192 wrote to memory of 3768	2192	omsecor.exe	95
PID 3768 wrote to memory of 4384	3768	omsecor.exe	96
PID 3768 wrote to memory of 4384	3768	omsecor.exe	96
PID 3768 wrote to memory of 4384	3768	omsecor.exe	96
PID 3768 wrote to memory of 4384	3768	omsecor.exe	96
PID 3768 wrote to memory of 4384	3768	omsecor.exe	96
PID 4384 wrote to memory of 2956	4384	omsecor.exe	98
PID 4384 wrote to memory of 2956	4384	omsecor.exe	98
PID 4384 wrote to memory of 2956	4384	omsecor.exe	98
PID 2956 wrote to memory of 832	2956	omsecor.exe	100
PID 2956 wrote to memory of 832	2956	omsecor.exe	100
PID 2956 wrote to memory of 832	2956	omsecor.exe	100
PID 2956 wrote to memory of 832	2956	omsecor.exe	100
PID 2956 wrote to memory of 832	2956	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe
"C:\Users\Admin\AppData\Local\Temp\a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe
  C:\Users\Admin\AppData\Local\Temp\a335c2d042ee4fdbba0995ce1f4b403f43614a075ac443085570c1aa673c1d80.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3768
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 252
        8⤵
        Program crash
        
        PID:612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 300
        6⤵
        Program crash
        
        PID:2072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 288
      4⤵
      Program crash
      PID:3124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 288
  2⤵
  - Program crash
  PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2148 -ip 2148
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4356 -ip 4356
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3768 -ip 3768
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2956 -ip 2956
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
a3d7b8db060dc0f00773c8ef4b22fbc9

SHA1
2a17e2a92eb400f85822d5ea13c051183a1ff9d3

SHA256
449eae3ac1b31aa6d68323bd6a281d75bb41cb38cc25a47061fcee19fdf36317

SHA512
d8853c032279fd9af9b695d669ccc8698fac217a53269a0a7e2c126215fea4bba74136f38cdaa4b0653a52d487f283adcbc735c2cdd3ff9ef5afe0fc34b8952a

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
6775671efd0194f7d6e0c60745c5309c

SHA1
601c01db0abf8dfc7aeecf85e24d1b1e456e559b

SHA256
3f84a7c96fd7357f8936158ba90a1f275e8b645348b1d15ce7b9a20776531594

SHA512
661fd8fa51958b02b0d3fe43b29b12f059fa6741f21395d2750cf44ae6954ae61b7c93d0480eb29edad18423f5e3fc635a7dcfec2054013d74dacfc94ad0c52b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
a36e4006d0a7b6c35d727d275961b3fa

SHA1
dd95cb2f8c20ed2d340b0eec55259b61bce73b99

SHA256
2885d8160a7fd943192f60b2cbe2844c14591c4cbf68b7c4072ca2b593244ecd

SHA512
97aaed6836fdde7ab0577a95d40cf40d809c283daa6f34058009cfc61e28df5e211cfb19e94c14719c1c44bd1817caf845ad912f56143fde260ff56fa9d993b4

Download Submit
memory/832-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/832-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/832-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2148-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2148-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2192-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2192-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2956-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3768-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3768-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4356-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4356-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4384-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download