neconyd | 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2025, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
Size

61KB
MD5

a74cb5983f2c35758dbfb8918f1c1de3
SHA1

8d44cd64264c145feeb9ce87f9a77e4c3edca65e
SHA256

17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f
SHA512

4cc0792d2bb0ba057a0812262adabdc076a9bca756b25ee8b8a3fdda9d2e4e6b888c3202dac93b1397d75a61dd674125014a59a8e853c942c6bd308e90530bf3
SSDEEP

1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZll/5:ydseIOMEZEyFjEOFqTiQmPl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4208	omsecor.exe
1520	omsecor.exe
2272	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4208	1724	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	82
PID 1724 wrote to memory of 4208	1724	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	82
PID 1724 wrote to memory of 4208	1724	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	82
PID 4208 wrote to memory of 1520	4208	omsecor.exe	92
PID 4208 wrote to memory of 1520	4208	omsecor.exe	92
PID 4208 wrote to memory of 1520	4208	omsecor.exe	92
PID 1520 wrote to memory of 2272	1520	omsecor.exe	93
PID 1520 wrote to memory of 2272	1520	omsecor.exe	93
PID 1520 wrote to memory of 2272	1520	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
"C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
41422c255d5f2705e193a5b309e1fe5d

SHA1
0eb19a01a8dc99420dd77b3a39f0672c729391a9

SHA256
ef23364585d9242c5fdbda6268ba296d2a68106ed4085f08512edb6d5f913ed7

SHA512
b697b2f63eb83a9432d0b433a5dc8c64db4e878830f43b37d3609521630c83037bfb92cc06a5eef28e16c1c0ebe765b82f8577a985f1525f1df09786a93be888

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
6cf2457d1ed3508b97412f694ef399f7

SHA1
2bef013201a89766480d54e714c1bde6a61a8cca

SHA256
c2a8559aaee120eb7b3002860244c1c4634cbb9ed6a40d365df35dfc1dcafa49

SHA512
5d90214573b34bfc914aba2c34515fcd03a585fc02f58e82c4214906e3f2266b15a7fcacc2f9cbca5f97f3842df883b2064c53064b74ffc65ae6613dd8079dbe

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
31adaaffb0f056219ce67ecaf78fd410

SHA1
13c17acc7f147ecabedf7ca2cc8af3f37191a3a9

SHA256
863df7612e07bcf56b6c6521bbe1557a88e97c8028946b5bf90250672ee47250

SHA512
baa8eb4b233937a46aa57be3a02b7e6b50eb472af06349728ca74a341eb7e06d2d86724ba107c0056225658f3341f32bc675bad706d004b77c64b3d9e67cd6b5

Download Submit