neconyd | 8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906f

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe
Size

72KB
MD5

e834652c7d8b9c50ec3808e8120392b0
SHA1

4877b6cf5497b81a3a1e70854d64f63bc7d4fd69
SHA256

8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906f
SHA512

b78e5d99e5ddb3afe7883054694bcdfc86a810620bb47e62eb6e86d93cae2394cfd447b64ee2de0d5a723fd692fbf5698a8fa64e59ddac5e44d3f2cc0f2dd784
SSDEEP

1536:9Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211v:jdseIOMEZEyFjEOFqTiQm5l/5211v

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4236	omsecor.exe
4508	omsecor.exe
2500	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4236	1236	8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe	85
PID 1236 wrote to memory of 4236	1236	8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe	85
PID 1236 wrote to memory of 4236	1236	8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe	85
PID 4236 wrote to memory of 4508	4236	omsecor.exe	103
PID 4236 wrote to memory of 4508	4236	omsecor.exe	103
PID 4236 wrote to memory of 4508	4236	omsecor.exe	103
PID 4508 wrote to memory of 2500	4508	omsecor.exe	104
PID 4508 wrote to memory of 2500	4508	omsecor.exe	104
PID 4508 wrote to memory of 2500	4508	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe
"C:\Users\Admin\AppData\Local\Temp\8284cc86af9962658a04f5276542d7b9c3ad8d66291a35f733fcdaf36c03906fN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
53763bc90863fea9410e33d7f4a1f9cb

SHA1
455213afb1072127920fb52b9e53c890a022a974

SHA256
15fe0a56e5f57f4235cb7df767431c25b5ab3dda147cb052410e59c396356287

SHA512
e8cae35ed9b5059565dd48c9a49b3bab10c9b4ac6c192d800e5d31c6d5f4061b1aeaf39aa3923da9f3518d253a1e47a788cd90aa0f63648ff261f499475f839b

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
f81810a12b8facfc00410541399bf630

SHA1
4022948bdc69efaf5c9f9d20b02d84c8f72385d6

SHA256
46e1d6b5bbd081143431128b858697035e6473cb76ca111d9a154b61a2d66744

SHA512
f7beedc2ee5bf5a48a8b5a5d71aab8aa4095d46b0f8b027f9295bef3c3b9a667037ca232586e0eac39e4ec051fd26724482d971430d18564fee29c5e764f8c4b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
1f5350f2bcab61379f524fbdb515c13b

SHA1
103b1ab7514c35a344dcafb8f51ad771488050fe

SHA256
0d045fc72a5e4d34beb70dfb25bb22307e37046ce8b8d231c927604824a6bfe2

SHA512
1cb1962b4820bbd5c72e5d0d8c2e7ff13be46f432adcc3f40290b18e35002c3948687a606ae4b017776d82b043fcd462327721cc0ee0e237c18887022c2ae6f6

Download Submit