neconyd | 95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe
Size

96KB
MD5

0227405c46639b2222a17b83703ea91d
SHA1

7ad2d760e13d1751c215bff82a1fc2f72c921c6c
SHA256

95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826
SHA512

4ec8b16e975fab0714d79c3b579037ae4dc50d3ab75eadbfa62f606e299f9fd0e4727870e0ebc61eaa8ff0e6eab14377a9020980ddbb9ef9631118639ac6618f
SSDEEP

1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:NGs8cd8eXlYairZYqMddH13z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3100	omsecor.exe
1724	omsecor.exe
1260	omsecor.exe
1556	omsecor.exe
2224	omsecor.exe
1432	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 412 set thread context of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 3100 set thread context of 1724	3100	omsecor.exe	88
PID 1260 set thread context of 1556	1260	omsecor.exe	109
PID 2224 set thread context of 1432	2224	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4180	412	WerFault.exe	82
5096	3100	WerFault.exe	85
2264	1260	WerFault.exe	108
1560	2224	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 412 wrote to memory of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 412 wrote to memory of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 412 wrote to memory of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 412 wrote to memory of 3052	412	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	83
PID 3052 wrote to memory of 3100	3052	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	85
PID 3052 wrote to memory of 3100	3052	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	85
PID 3052 wrote to memory of 3100	3052	95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe	85
PID 3100 wrote to memory of 1724	3100	omsecor.exe	88
PID 3100 wrote to memory of 1724	3100	omsecor.exe	88
PID 3100 wrote to memory of 1724	3100	omsecor.exe	88
PID 3100 wrote to memory of 1724	3100	omsecor.exe	88
PID 3100 wrote to memory of 1724	3100	omsecor.exe	88
PID 1724 wrote to memory of 1260	1724	omsecor.exe	108
PID 1724 wrote to memory of 1260	1724	omsecor.exe	108
PID 1724 wrote to memory of 1260	1724	omsecor.exe	108
PID 1260 wrote to memory of 1556	1260	omsecor.exe	109
PID 1260 wrote to memory of 1556	1260	omsecor.exe	109
PID 1260 wrote to memory of 1556	1260	omsecor.exe	109
PID 1260 wrote to memory of 1556	1260	omsecor.exe	109
PID 1260 wrote to memory of 1556	1260	omsecor.exe	109
PID 1556 wrote to memory of 2224	1556	omsecor.exe	111
PID 1556 wrote to memory of 2224	1556	omsecor.exe	111
PID 1556 wrote to memory of 2224	1556	omsecor.exe	111
PID 2224 wrote to memory of 1432	2224	omsecor.exe	113
PID 2224 wrote to memory of 1432	2224	omsecor.exe	113
PID 2224 wrote to memory of 1432	2224	omsecor.exe	113
PID 2224 wrote to memory of 1432	2224	omsecor.exe	113
PID 2224 wrote to memory of 1432	2224	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe
"C:\Users\Admin\AppData\Local\Temp\95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Local\Temp\95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe
  C:\Users\Admin\AppData\Local\Temp\95657944717b819a78e9a20d6a159167ce0ba71423b7e101ece9a2e7e3e3d826.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1260
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 256
        8⤵
        Program crash
        
        PID:1560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 304
        6⤵
        Program crash
        
        PID:2264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 296
      4⤵
      Program crash
      PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 288
  2⤵
  - Program crash
  PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 412 -ip 412
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3100 -ip 3100
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1260 -ip 1260
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2224 -ip 2224
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5bc550f4bfc657e269cc29b9f6944cc7

SHA1
48535498fa7a1e43f3c6ce88d9f454d2a8d13785

SHA256
99f2f59693b312b89f7232bc5aa75f11c1c8d309c383d8c727a93f4883672655

SHA512
75475c3840f688386bc8357d41b4201d22514b36bc58c331ade4f3f427798896b2ee1476fd250d810db7d24a5f91b33e2b03d3dd6307f331f4698894bdb39545

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
e9470ecb24071cfddb9f6514f7fd7668

SHA1
5cc474de5d81b3d88e5f1f9ab2a355e16b8f9ff2

SHA256
24525ddd73ea62d3d419c42cfadc60adccdcad6585a74d9d99c2cc1fd56e449d

SHA512
f638015f693251933ba3ce638bb2595ebfa9e4d2547a6e7772a72d0e03c940f91d64d49948f03d932555d7433f1eba672fd42cd0d4baf94ec3c574e2ac792eb1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
5ac1655ed3d4679488878d4616b44e56

SHA1
4ad0ca2124b0c798cb850fd2b96ac23ddc0e1acb

SHA256
f587e311cbb2eeb88934b4d78dfa0c01e43f408ddfce005ed516fc483cdc7893

SHA512
9614f8ee24381b37d5a503de3552fadda14142d46b4c9627f878920735f7f575401aea71f577d60fe63ed21fd156c1995a04bc29e0df86714770c2a497f1f3a8

Download Submit
memory/412-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/412-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1260-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1260-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1432-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1432-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1432-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1432-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1556-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1556-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1556-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2224-42-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2224-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3052-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3100-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3100-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download