neconyd | 71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Size

96KB
MD5

222bfbca7c8bce5d38157745ae9a367e
SHA1

15ad9d1af48d3fa455a79ffa3e85636170404817
SHA256

71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f
SHA512

f7675a4dee7e4f91898e279c5e059e24072c9038eb60901ceee50c393c5597987b939a56a9e4eacce11a398d4fa1c62732cb6391772474b6b47e99815a0bbdea
SSDEEP

1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:SGs8cd8eXlYairZYqMddH137

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3464	omsecor.exe
448	omsecor.exe
228	omsecor.exe
1976	omsecor.exe
1112	omsecor.exe
3948	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 3464 set thread context of 448	3464	omsecor.exe	87
PID 228 set thread context of 1976	228	omsecor.exe	100
PID 1112 set thread context of 3948	1112	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3992	1048	WerFault.exe	81
1816	3464	WerFault.exe	84
1528	228	WerFault.exe	99
1912	1112	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 1048 wrote to memory of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 1048 wrote to memory of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 1048 wrote to memory of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 1048 wrote to memory of 2512	1048	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	82
PID 2512 wrote to memory of 3464	2512	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	84
PID 2512 wrote to memory of 3464	2512	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	84
PID 2512 wrote to memory of 3464	2512	71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe	84
PID 3464 wrote to memory of 448	3464	omsecor.exe	87
PID 3464 wrote to memory of 448	3464	omsecor.exe	87
PID 3464 wrote to memory of 448	3464	omsecor.exe	87
PID 3464 wrote to memory of 448	3464	omsecor.exe	87
PID 3464 wrote to memory of 448	3464	omsecor.exe	87
PID 448 wrote to memory of 228	448	omsecor.exe	99
PID 448 wrote to memory of 228	448	omsecor.exe	99
PID 448 wrote to memory of 228	448	omsecor.exe	99
PID 228 wrote to memory of 1976	228	omsecor.exe	100
PID 228 wrote to memory of 1976	228	omsecor.exe	100
PID 228 wrote to memory of 1976	228	omsecor.exe	100
PID 228 wrote to memory of 1976	228	omsecor.exe	100
PID 228 wrote to memory of 1976	228	omsecor.exe	100
PID 1976 wrote to memory of 1112	1976	omsecor.exe	102
PID 1976 wrote to memory of 1112	1976	omsecor.exe	102
PID 1976 wrote to memory of 1112	1976	omsecor.exe	102
PID 1112 wrote to memory of 3948	1112	omsecor.exe	104
PID 1112 wrote to memory of 3948	1112	omsecor.exe	104
PID 1112 wrote to memory of 3948	1112	omsecor.exe	104
PID 1112 wrote to memory of 3948	1112	omsecor.exe	104
PID 1112 wrote to memory of 3948	1112	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
"C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
  C:\Users\Admin\AppData\Local\Temp\71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:448
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:228
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 252
        8⤵
        Program crash
        
        PID:1912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 292
        6⤵
        Program crash
        
        PID:1528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 288
      4⤵
      Program crash
      PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 288
  2⤵
  - Program crash
  PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1048 -ip 1048
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3464 -ip 3464
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 228 -ip 228
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1112 -ip 1112
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
4b9ad3aa16f3d795383e0bf7426431b3

SHA1
68d748a5bed6d3376caa7abebbd5d9ca894e042d

SHA256
3b0bb77c9268eefe41d1293a9a43b3d1cf74b3ec98aa786a89ef03198d79eb68

SHA512
3d2722364762255113226eee6ea03b59d52e9ce7b9008ca8396238f94e3adc84827dec6d74f2ce01819cf0646900110ad97d05e1a2792e6c00e87d6d385b8db3

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
885622bf0da9dd436506199cb00bd5d6

SHA1
644222e55b1e9be104adc469322e12945b9bb606

SHA256
de4eaf010004ccb97aa1d2ec6a6f569885f6271642d2b0752958d9b4fbbc0d70

SHA512
5d064fd3c103c2cf4c14432a27c1a4ceb0f5f6e49570ec7cf14bed043c1d4c20a1e747df54c4db05f008c9654e5cd6822207970fabc94d7b3c6ec4143811ce04

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
e6e452caa5f3b4b54bc8b67dd6e3fe94

SHA1
5a1b341b703eead9f12f06cabfba8e83ea4580e8

SHA256
cdb2f3c338c5f1c583f4085e249882410cb298d72f24e4e9e0d48af7ffad2f2d

SHA512
21aef1db19063dbe9a022ae1951be8eb71860dfdcba99d2b70f1f77628e80aa7ed96ff3b1ad874c930a33cfc2efe00278f8aba3a04d592b540ccdcfeee2a741d

Download Submit
memory/228-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/228-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/448-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/448-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1048-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1048-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1112-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1976-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3464-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3464-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3948-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3948-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3948-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download