neconyd | 1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe
Size

65KB
MD5

c064549c82649f9e5e14e6fa3c6c011d
SHA1

459b8287523fe2a9bb354076b0b028d8fea5e52e
SHA256

1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6
SHA512

b71ca64e5513b60ae5ddd3e4f8fce324d1a32be6a463e5d802f46a8f41ea3fe05bb22f4ea647fcc2ef229d675cd2fa61d32dbc365f172154892d4d9e74ff4963
SSDEEP

1536:4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz/:IdseIO+EZEyFjEOFqTiQmRHz/

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
5068	omsecor.exe
4764	omsecor.exe
1108	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 5068	4124	1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe	83
PID 4124 wrote to memory of 5068	4124	1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe	83
PID 4124 wrote to memory of 5068	4124	1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe	83
PID 5068 wrote to memory of 4764	5068	omsecor.exe	100
PID 5068 wrote to memory of 4764	5068	omsecor.exe	100
PID 5068 wrote to memory of 4764	5068	omsecor.exe	100
PID 4764 wrote to memory of 1108	4764	omsecor.exe	101
PID 4764 wrote to memory of 1108	4764	omsecor.exe	101
PID 4764 wrote to memory of 1108	4764	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe
"C:\Users\Admin\AppData\Local\Temp\1a460dd4e9bda187bc2cac73e33eb188a448891c226ae16596e2d3ac4fafe9c6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
4efd08b2958c519132f6e975019da3c1

SHA1
bd11a1d577d107e956387ee9b9d4ea34e44ac587

SHA256
7b06d9c4ea8ff2b845cb7c17e2d9f4ba04a1d8d2b11a1f7ad3fbc287610260e1

SHA512
919dee59c62befc13e509ee77dc829774187cb4481d9991095c473e901b26e4772a2880dae197759ea58d084963b393a916a7642fdfb65403e2e7408f0737b72

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
a4afa73a120789b79866439e80615aff

SHA1
3d2c27342bef2f3b2b001a31937953a27f42a035

SHA256
41c12c5a13626fd9c4326a3b25cac1e07bb069750250b30914088844630b7943

SHA512
934ba1dd0bea2aaf08b6d8a2e100869200269dafff79b66cf4c41ba890a7334fa2798d040292d2159fd089b0317388ffaa8c4821ece50cb1dfc2faba6c2edab4

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
4602621d578a1e35330dab394a50adac

SHA1
b8741790fbb145b79fdac7456c6a20f61d26ca7d

SHA256
8086a5f8dc4b86fd58fe526a9f9bab5279766e697e626b6ab50a1c58369a6bc8

SHA512
e8f4a613f0b69edf8e44184f14521d152bc6225878e1e38cff75ab253ad97477094c17d63a40bd5ee19eb24d7879550b0c68801e0d8916b5959749ed1b86a303

Download Submit
memory/1108-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1108-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4124-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4124-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4764-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4764-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5068-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5068-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5068-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download