neconyd | 71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-01-2025 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Size

96KB
MD5

222bfbca7c8bce5d38157745ae9a367e
SHA1

15ad9d1af48d3fa455a79ffa3e85636170404817
SHA256

71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f
SHA512

f7675a4dee7e4f91898e279c5e059e24072c9038eb60901ceee50c393c5597987b939a56a9e4eacce11a398d4fa1c62732cb6391772474b6b47e99815a0bbdea
SSDEEP

1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:SGs8cd8eXlYairZYqMddH137

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2512	omsecor.exe
2408	omsecor.exe
588	omsecor.exe
2012	omsecor.exe
1588	omsecor.exe
3040	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
2512	omsecor.exe
2408	omsecor.exe
2408	omsecor.exe
2012	omsecor.exe
2012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2512 set thread context of 2408	2512	omsecor.exe	32
PID 588 set thread context of 2012	588	omsecor.exe	36
PID 1588 set thread context of 3040	1588	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2100 wrote to memory of 2092	2100	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	30
PID 2092 wrote to memory of 2512	2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	31
PID 2092 wrote to memory of 2512	2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	31
PID 2092 wrote to memory of 2512	2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	31
PID 2092 wrote to memory of 2512	2092	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	31
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2512 wrote to memory of 2408	2512	omsecor.exe	32
PID 2408 wrote to memory of 588	2408	omsecor.exe	35
PID 2408 wrote to memory of 588	2408	omsecor.exe	35
PID 2408 wrote to memory of 588	2408	omsecor.exe	35
PID 2408 wrote to memory of 588	2408	omsecor.exe	35
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 588 wrote to memory of 2012	588	omsecor.exe	36
PID 2012 wrote to memory of 1588	2012	omsecor.exe	37
PID 2012 wrote to memory of 1588	2012	omsecor.exe	37
PID 2012 wrote to memory of 1588	2012	omsecor.exe	37
PID 2012 wrote to memory of 1588	2012	omsecor.exe	37
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38
PID 1588 wrote to memory of 3040	1588	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
"C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
  C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:588
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
885622bf0da9dd436506199cb00bd5d6

SHA1
644222e55b1e9be104adc469322e12945b9bb606

SHA256
de4eaf010004ccb97aa1d2ec6a6f569885f6271642d2b0752958d9b4fbbc0d70

SHA512
5d064fd3c103c2cf4c14432a27c1a4ceb0f5f6e49570ec7cf14bed043c1d4c20a1e747df54c4db05f008c9654e5cd6822207970fabc94d7b3c6ec4143811ce04

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
643ababf0a1bf720b15c105b020c7336

SHA1
2601102fc4b95971639955321107728bbc6b43c8

SHA256
4d188434972b2d8b8c685555d31e46ba431dabd87f6a878dc452c35d971c69d7

SHA512
6e57b7c7d7ac78133b73fb326d4e5731c90fe3248a66d2a5bd7f8e9535734a913bc70a5a7f32a4977db3ca1d63147d19f94443d11e5060ae8415ded2e0962d19

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3ddb7925487d0967ed1b1caab4c822af

SHA1
4fc9fd09ecc3e6bfb6998d0ee745acc65d82db4a

SHA256
a5ab807a6f9a9eaaab900b9c3c8584b5c06f9ddcf33672e9f977c3aedceea9f6

SHA512
fbdde7cb6f09ed54e7e3e08cd7a7bdac7f4aac22822a7f422038e13b306c277661266cf22c6291bde1ae2e337425aeb7ed45ca5bd80469f1daab01c4c6c40fc6

Download Submit
memory/588-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/588-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1588-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1588-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2012-72-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2092-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-20-0x0000000000260000-0x0000000000283000-memory.dmp

Filesize
140KB

Download
memory/2100-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2100-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2408-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-47-0x0000000000470000-0x0000000000493000-memory.dmp

Filesize
140KB

Download
memory/2408-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2512-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3040-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download