neconyd | abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
Size

96KB
MD5

2409224fd7c3512819080b24bf97bd5e
SHA1

25d8ce08c39809a4e7dd40dba10d3ea3cdfb8f3e
SHA256

abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff
SHA512

c0c1abdb61ec763f3782ae30d0e3bac3904b007a62ace994453d5c964663276f8b6389d941b22ee9ba569bd36179beda2258804c004f8e06de2ec358d254b4fd
SSDEEP

1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:NGs8cd8eXlYairZYqMddH13b

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
5020	omsecor.exe
2068	omsecor.exe
1536	omsecor.exe
4592	omsecor.exe
2656	omsecor.exe
3292	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 5020 set thread context of 2068	5020	omsecor.exe	89
PID 1536 set thread context of 4592	1536	omsecor.exe	111
PID 2656 set thread context of 3292	2656	omsecor.exe	115

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4216	1116	WerFault.exe	84
876	5020	WerFault.exe	87
4752	1536	WerFault.exe	110
3952	2656	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 1116 wrote to memory of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 1116 wrote to memory of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 1116 wrote to memory of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 1116 wrote to memory of 4100	1116	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	85
PID 4100 wrote to memory of 5020	4100	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	87
PID 4100 wrote to memory of 5020	4100	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	87
PID 4100 wrote to memory of 5020	4100	abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe	87
PID 5020 wrote to memory of 2068	5020	omsecor.exe	89
PID 5020 wrote to memory of 2068	5020	omsecor.exe	89
PID 5020 wrote to memory of 2068	5020	omsecor.exe	89
PID 5020 wrote to memory of 2068	5020	omsecor.exe	89
PID 5020 wrote to memory of 2068	5020	omsecor.exe	89
PID 2068 wrote to memory of 1536	2068	omsecor.exe	110
PID 2068 wrote to memory of 1536	2068	omsecor.exe	110
PID 2068 wrote to memory of 1536	2068	omsecor.exe	110
PID 1536 wrote to memory of 4592	1536	omsecor.exe	111
PID 1536 wrote to memory of 4592	1536	omsecor.exe	111
PID 1536 wrote to memory of 4592	1536	omsecor.exe	111
PID 1536 wrote to memory of 4592	1536	omsecor.exe	111
PID 1536 wrote to memory of 4592	1536	omsecor.exe	111
PID 4592 wrote to memory of 2656	4592	omsecor.exe	113
PID 4592 wrote to memory of 2656	4592	omsecor.exe	113
PID 4592 wrote to memory of 2656	4592	omsecor.exe	113
PID 2656 wrote to memory of 3292	2656	omsecor.exe	115
PID 2656 wrote to memory of 3292	2656	omsecor.exe	115
PID 2656 wrote to memory of 3292	2656	omsecor.exe	115
PID 2656 wrote to memory of 3292	2656	omsecor.exe	115
PID 2656 wrote to memory of 3292	2656	omsecor.exe	115

C:\Users\Admin\AppData\Local\Temp\abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
"C:\Users\Admin\AppData\Local\Temp\abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
  C:\Users\Admin\AppData\Local\Temp\abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 256
        8⤵
        Program crash
        
        PID:3952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 292
        6⤵
        Program crash
        
        PID:4752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 288
      4⤵
      Program crash
      PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 288
  2⤵
  - Program crash
  PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1116 -ip 1116
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5020 -ip 5020
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1536 -ip 1536
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2656 -ip 2656
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
bbd179e5115a2f706fe1fa8e2581fbcd

SHA1
b50aeffb2851ad4736e1e5a15b59a89149153ba3

SHA256
10416537b06f4555159b630de3106e726a3b3ab1137158ae54177ea790e75ddf

SHA512
7f5c9cd50adf46ebd06695da1b7b20a27e36f4eec1325d757fea07b1c1b8ccdf5f44e3bccdc6373a54d3a789e87c3b079c5ef2a366132ab5864bb4597aa72ed6

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f6d0de1e153b96d45d2af24debee0065

SHA1
dbc4e562ac8a69a98996a4932f80110f35fa85f6

SHA256
eef7f5ed2364de596cb224379a05c30ed59272e8a0fc7c08e5124bedce0da698

SHA512
a7efec826c1703f2fc5170588852e416a5ee54d47e3fd2bf217349e33956bb2598ba4b1f243a7befb195c29f140732b235bb35dc7190304ef556391b1b1e9478

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
00ac1fe25d255678451debe58c867b31

SHA1
ba16537fc277430ad6bfa8c23d90a8e7ad57da7c

SHA256
2462923480c6d47cd0859266b29f7c623a5cc8579e751ced7f6520468f67ddc0

SHA512
7f8252c16501e46efeb3f90cc150fc301fc4d42dfa8d986c8cf872189dbcb1de71be28e4ec09754a5b95f1d7ef10579535a64c048df0df89cc4b5e1aa71cb9e0

Download Submit
memory/1116-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1116-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1536-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1536-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2068-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-44-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3292-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3292-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3292-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4100-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4100-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4100-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4100-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5020-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download