neconyd | fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
Size

96KB
MD5

62e4558b0fdffc45964bb16a5a23a5ee
SHA1

fb067f4423b7c85df8565b27ff015fa5f8e35b23
SHA256

fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d
SHA512

7ccecace029db244772aa3637b9b6bb283ddaacbdde08cbc6e95290fdd790a2cd0be97b37ae7478a4b1dd443365ef87b561fa369e5b5a562b33506509417ede9
SSDEEP

1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:4Gs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2784	omsecor.exe
2340	omsecor.exe
1888	omsecor.exe
1416	omsecor.exe
2356	omsecor.exe
1292	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
2784	omsecor.exe
2340	omsecor.exe
2340	omsecor.exe
1416	omsecor.exe
1416	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2784 set thread context of 2340	2784	omsecor.exe	32
PID 1888 set thread context of 1416	1888	omsecor.exe	36
PID 2356 set thread context of 1292	2356	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2736 wrote to memory of 2656	2736	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	30
PID 2656 wrote to memory of 2784	2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	31
PID 2656 wrote to memory of 2784	2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	31
PID 2656 wrote to memory of 2784	2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	31
PID 2656 wrote to memory of 2784	2656	fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe	31
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2784 wrote to memory of 2340	2784	omsecor.exe	32
PID 2340 wrote to memory of 1888	2340	omsecor.exe	35
PID 2340 wrote to memory of 1888	2340	omsecor.exe	35
PID 2340 wrote to memory of 1888	2340	omsecor.exe	35
PID 2340 wrote to memory of 1888	2340	omsecor.exe	35
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1888 wrote to memory of 1416	1888	omsecor.exe	36
PID 1416 wrote to memory of 2356	1416	omsecor.exe	37
PID 1416 wrote to memory of 2356	1416	omsecor.exe	37
PID 1416 wrote to memory of 2356	1416	omsecor.exe	37
PID 1416 wrote to memory of 2356	1416	omsecor.exe	37
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38
PID 2356 wrote to memory of 1292	2356	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
"C:\Users\Admin\AppData\Local\Temp\fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
  C:\Users\Admin\AppData\Local\Temp\fbed82a4fea09b2eab3bf28e53ae1e425cb5256b943af573534c01414a599c0d.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
6fe5522c701c5b1122616b91652e5dd6

SHA1
40edd3e6c6c94ef5af55ec00ab03dbe40598da57

SHA256
68afc70600a8bad5dd5d95a6c0342032075a25189d0b720cbb1c1699da34dc82

SHA512
29d2553011fd17f280a5e7f8538b734d0d0d0d40d0964ca33f6c293d59da4d78071ad8da9495a9dbd06a7e8b8da61e515e201f7ea25c3a83765c753b801bfaaa

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
993617a18c826596e0c616ee1603a7dc

SHA1
11e4ed23c39c2043a489878d3fb79731405d8596

SHA256
93545b0dc8e80c177ec46dd243e67e7f89f8f4fcc7e488353d0f66f5302f48e3

SHA512
6cef840518d6cdc879aa4bef12049f09328eb12c787acd86f8e06ea79b1494aef626b2e0026c57047262d180bfc017d8785c1238a190c3c4b9ca94483462adef

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
b310b8d014adf07c42f4406ad0b5a6cb

SHA1
392c8222797712fa24abc9dfea3bc96381e96adc

SHA256
4f2be8f9bc5663d654ea05172a372b209ce65b3e14d3443042a5238d1c48bc33

SHA512
12f09cc50f77839350fd3e983cea9e012d8425f695c9bb9f5d842a1ed9cfdaf9232eef969ae906210e43f7df5e35f69002866694a6c041debbf167a5ae5c74ec

Download Submit
memory/1292-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1292-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1416-74-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1888-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1888-59-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2340-54-0x0000000000360000-0x0000000000383000-memory.dmp

Filesize
140KB

Download
memory/2340-55-0x0000000000360000-0x0000000000383000-memory.dmp

Filesize
140KB

Download
memory/2340-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2340-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2340-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2340-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2340-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2356-89-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2656-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2656-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2736-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2736-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2784-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2784-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download