neconyd | 073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
Size

96KB
MD5

cd9bbefa014cd325ab8772ae0d20a370
SHA1

4ffd6ac0bd71f2fc8bbaa3e690ff7ed1344a28a2
SHA256

073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66
SHA512

69a56700f19f7298cf0ad599c3b4641548861e3d8d746b2043c0cc0c3a12e148b389b7a02045509e906b9bf718761b1b25367de47172665cf225e371afbf3327
SSDEEP

1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:HGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1352	omsecor.exe
2356	omsecor.exe
2288	omsecor.exe
2328	omsecor.exe
2424	omsecor.exe
3028	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 1352 set thread context of 2356	1352	omsecor.exe	88
PID 2288 set thread context of 2328	2288	omsecor.exe	108
PID 2424 set thread context of 3028	2424	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1396	2808	WerFault.exe	82
2648	1352	WerFault.exe	85
2264	2288	WerFault.exe	107
1920	2424	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 2808 wrote to memory of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 2808 wrote to memory of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 2808 wrote to memory of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 2808 wrote to memory of 3244	2808	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	83
PID 3244 wrote to memory of 1352	3244	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	85
PID 3244 wrote to memory of 1352	3244	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	85
PID 3244 wrote to memory of 1352	3244	073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe	85
PID 1352 wrote to memory of 2356	1352	omsecor.exe	88
PID 1352 wrote to memory of 2356	1352	omsecor.exe	88
PID 1352 wrote to memory of 2356	1352	omsecor.exe	88
PID 1352 wrote to memory of 2356	1352	omsecor.exe	88
PID 1352 wrote to memory of 2356	1352	omsecor.exe	88
PID 2356 wrote to memory of 2288	2356	omsecor.exe	107
PID 2356 wrote to memory of 2288	2356	omsecor.exe	107
PID 2356 wrote to memory of 2288	2356	omsecor.exe	107
PID 2288 wrote to memory of 2328	2288	omsecor.exe	108
PID 2288 wrote to memory of 2328	2288	omsecor.exe	108
PID 2288 wrote to memory of 2328	2288	omsecor.exe	108
PID 2288 wrote to memory of 2328	2288	omsecor.exe	108
PID 2288 wrote to memory of 2328	2288	omsecor.exe	108
PID 2328 wrote to memory of 2424	2328	omsecor.exe	110
PID 2328 wrote to memory of 2424	2328	omsecor.exe	110
PID 2328 wrote to memory of 2424	2328	omsecor.exe	110
PID 2424 wrote to memory of 3028	2424	omsecor.exe	112
PID 2424 wrote to memory of 3028	2424	omsecor.exe	112
PID 2424 wrote to memory of 3028	2424	omsecor.exe	112
PID 2424 wrote to memory of 3028	2424	omsecor.exe	112
PID 2424 wrote to memory of 3028	2424	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
"C:\Users\Admin\AppData\Local\Temp\073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
  C:\Users\Admin\AppData\Local\Temp\073f024fb1923ce0297162adcfcfa2b22d568513f6942fc5a2ea5bea2885fb66N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 256
        8⤵
        Program crash
        
        PID:1920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 296
        6⤵
        Program crash
        
        PID:2264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 288
      4⤵
      Program crash
      PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 300
  2⤵
  - Program crash
  PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1352 -ip 1352
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2288 -ip 2288
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2424 -ip 2424
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
86d54888bafc101606184592513ee734

SHA1
50b61b0696f7e602be85998f24df602b4861cf18

SHA256
f77a18e76c511ae8feeb8abc6b6bf2566c4add96c5f0912458f6601039be0a55

SHA512
93c8840aadfb119c298db6c7807214e3a4031ae8b960d810ae0cc7f650426378d15641ab5065c3226a4e3b9e2008bafb6a6e217caa558993298f884e311bb31b

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
7f4457ce53b447b679c89ade501eb727

SHA1
0dfd91a067053f528f37118157fffe83670152de

SHA256
1f44817058135a9a9ed940e66aaabe559f7f070151d6edd09363fae86521f2b8

SHA512
a42873acb9f80d87513e32607dc2f985481168639fc36532b80b69a4c9a6aa59d26b9cbeae443406a244fffe6464a4068b4d365e73fa8c7c79b8a513eb3c375a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
1bd2d95150196c42544a02e1f08eaab2

SHA1
f6dd2d1a1c648c919ceef7573a72cb11eb21e687

SHA256
4b6ae721ee2cb2de63924405a02b13cc839f77e5aaf60b2792f2f239f2d86e22

SHA512
662122d35eda6da84baabd433f67eae0308fa3603070ded4fcd2a308e8b714e53735afac2495d07afd053e8e0c7b54a2d229e4e31f24a879c37161453119cd98

Download Submit
memory/1352-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1352-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2288-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2288-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2328-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2328-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2328-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2424-44-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2424-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2808-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2808-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3028-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3028-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3028-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download