neconyd | 5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
Size

76KB
MD5

e625719f383b6b647d52a79ca97e1340
SHA1

c880a72b4edb2318640e08bc3c5d94ce2279280f
SHA256

5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02
SHA512

f4e9a93ea055a58973e8adab385e2a01565206bfb657c4dcc36aff8341da27354df94a4bc95f257c988be0bd5cdd2ebf9bd41dc5d4baa92f77a9a5b1f97ecc78
SSDEEP

1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11b:XdseIOMEZEyFjEOFqaiQm5l/5w11b

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1868	omsecor.exe
3576	omsecor.exe
4444	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1868	4112	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	83
PID 4112 wrote to memory of 1868	4112	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	83
PID 4112 wrote to memory of 1868	4112	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	83
PID 1868 wrote to memory of 3576	1868	omsecor.exe	100
PID 1868 wrote to memory of 3576	1868	omsecor.exe	100
PID 1868 wrote to memory of 3576	1868	omsecor.exe	100
PID 3576 wrote to memory of 4444	3576	omsecor.exe	101
PID 3576 wrote to memory of 4444	3576	omsecor.exe	101
PID 3576 wrote to memory of 4444	3576	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
"C:\Users\Admin\AppData\Local\Temp\5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
cde732ab955bce75b5c4e130f71dd2a0

SHA1
3f579f59ea9dc6ef347bc651eb7c2d69ef7579f6

SHA256
a132a5537ddd4d38f221b54c6b58c513a1fd257f34c1bbf3df507e91157a5712

SHA512
eaf858be85af2161185ca071efb0ae2a40b1574630f02c7d395bddb1b5b9a6ed39021d69a6471533e4907acd840cd1631dc114efcdbb6ab779f96b7906585f28

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
7ee49d0d86e97854e51f91a421849168

SHA1
75b50ef899f91312cf359ec52ad3ba66a991019c

SHA256
0f2741b54aad10152414c3fbd48175dfd77bedf269f6ced5c104f75b431ebc94

SHA512
833c77342f6aa5b1d0bfdd2b9d7b2ab52c227c70fe8602081893a79aef61e4e6dfa36e10f8de3f3660cdf5da102df635357d21e8c2211a75f03ab9140472a6a1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
8e52a2a3945a522e2c92c84f697d1d79

SHA1
ded43f2b2b727cc948bc7643afb02caef45a6311

SHA256
6d6903a44a6aea25a276cf679d86f1814410f75b80af8b164dfb8a42810b2793

SHA512
ab35876039bb148c47a0a5226ddf0b9b2e4f407ac611353efa754d4ac2e5976edcfce84df2e8cef61b73687a5ff1df0ced1f7d78f376f9c2137a17fc7f871342

Download Submit
memory/1868-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1868-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1868-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3576-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3576-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4112-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4112-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4444-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4444-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download