neconyd | a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
Size

96KB
MD5

3741f3d1409a19365929b6bd1dee01d6
SHA1

da584cee4bebddcd5f48bb30c883c8950b5e160d
SHA256

a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7
SHA512

37a764e84764ebf79138ea4cfa70d72ffd351d4ba3b8d23c97510452b7712bb15c7dda8f6189e69e19c8ae1bc06aa4f42eb299213a6d9b110ce75607d453e9e5
SSDEEP

1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:xGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3216	omsecor.exe
4068	omsecor.exe
1836	omsecor.exe
2304	omsecor.exe
1436	omsecor.exe
1336	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 3216 set thread context of 4068	3216	omsecor.exe	87
PID 1836 set thread context of 2304	1836	omsecor.exe	100
PID 1436 set thread context of 1336	1436	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4092	5056	WerFault.exe	81
4972	3216	WerFault.exe	85
2332	1836	WerFault.exe	99
1208	1436	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 5056 wrote to memory of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 5056 wrote to memory of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 5056 wrote to memory of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 5056 wrote to memory of 5012	5056	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	82
PID 5012 wrote to memory of 3216	5012	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	85
PID 5012 wrote to memory of 3216	5012	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	85
PID 5012 wrote to memory of 3216	5012	a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe	85
PID 3216 wrote to memory of 4068	3216	omsecor.exe	87
PID 3216 wrote to memory of 4068	3216	omsecor.exe	87
PID 3216 wrote to memory of 4068	3216	omsecor.exe	87
PID 3216 wrote to memory of 4068	3216	omsecor.exe	87
PID 3216 wrote to memory of 4068	3216	omsecor.exe	87
PID 4068 wrote to memory of 1836	4068	omsecor.exe	99
PID 4068 wrote to memory of 1836	4068	omsecor.exe	99
PID 4068 wrote to memory of 1836	4068	omsecor.exe	99
PID 1836 wrote to memory of 2304	1836	omsecor.exe	100
PID 1836 wrote to memory of 2304	1836	omsecor.exe	100
PID 1836 wrote to memory of 2304	1836	omsecor.exe	100
PID 1836 wrote to memory of 2304	1836	omsecor.exe	100
PID 1836 wrote to memory of 2304	1836	omsecor.exe	100
PID 2304 wrote to memory of 1436	2304	omsecor.exe	102
PID 2304 wrote to memory of 1436	2304	omsecor.exe	102
PID 2304 wrote to memory of 1436	2304	omsecor.exe	102
PID 1436 wrote to memory of 1336	1436	omsecor.exe	104
PID 1436 wrote to memory of 1336	1436	omsecor.exe	104
PID 1436 wrote to memory of 1336	1436	omsecor.exe	104
PID 1436 wrote to memory of 1336	1436	omsecor.exe	104
PID 1436 wrote to memory of 1336	1436	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
"C:\Users\Admin\AppData\Local\Temp\a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
  C:\Users\Admin\AppData\Local\Temp\a2e2a7bf237176b590ae010057a1db34f0019763c675b66c950f8f98dfa5d8e7.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 256
        8⤵
        Program crash
        
        PID:1208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 292
        6⤵
        Program crash
        
        PID:2332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 288
      4⤵
      Program crash
      PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 300
  2⤵
  - Program crash
  PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3216 -ip 3216
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1836 -ip 1836
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1436 -ip 1436
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
d81fc37cec943cec2903a583e7e35f3c

SHA1
b38018e16cc6703ab776e5b78843a8ccd1f6e8e1

SHA256
c559ff2f6c404db9f223703a493749d28a4a0b34c218e7c9a17acba329fb9824

SHA512
c1f6ff376470da3299c74aff5455fff6c4e19db160620901180220b8996bd32c1e0e77e8702f61e9f94d05530809418df6f30a17f193d7eb93a3bb8e723393ff

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
3f8bba03c981efd8f5a58855bd9b29df

SHA1
25a428aa709764c7316888d8fa6b71dcf693ad5a

SHA256
d4d60eb1ed15d9f84b6926080379abeeb07027c7ab66c8e86e232c4963adb3ee

SHA512
3b79053e7be7af9ceec97f6affe4f469450c284106ee0c8fd4034eaa5ca2b51a323e4a3542c46f63dbd1d29973243c0c775708027781b6832b52fd9e258250fb

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
5d56860d588a02eaf1fb091b67a40d8b

SHA1
30f0e55b7a6b64d38f399ab9d1ce51eccf0b1761

SHA256
3506754875125074a9d15a4d2bc244b7c219a44e64335c431b68b76f09c2003f

SHA512
3af3765b068a4884a40a1735c20ff79dd6727ffaa6fbfde6979cef39209703e4c60268870f186b2f5ab87439e5b55ef8b9acb87be25b35b7616337f273bafc1c

Download Submit
memory/1336-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1336-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1336-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1436-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1436-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1836-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1836-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2304-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3216-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3216-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4068-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5012-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5012-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5012-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5012-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5056-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5056-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download