neconyd | 8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
Size

96KB
MD5

5432acb02d764b24c9476a9e39478a5d
SHA1

73ed59c6a4624c2b6785deba7a44d06b3a2ffb53
SHA256

8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf
SHA512

b07ed46e3487e942a03d6009bd8bd101567c6699ac3374e51a0358789e2c058b46c33b918d29c26a8726a07e6608a47ed8c1f5d8b53cc1e31717cacc16439ea0
SSDEEP

1536:QnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:QGs8cd8eXlYairZYqMddH13r

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1684	omsecor.exe
968	omsecor.exe
1384	omsecor.exe
2012	omsecor.exe
1744	omsecor.exe
2924	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
1684	omsecor.exe
968	omsecor.exe
968	omsecor.exe
2012	omsecor.exe
2012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 1684 set thread context of 968	1684	omsecor.exe	32
PID 1384 set thread context of 2012	1384	omsecor.exe	36
PID 1744 set thread context of 2924	1744	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2128 wrote to memory of 2180	2128	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	30
PID 2180 wrote to memory of 1684	2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	31
PID 2180 wrote to memory of 1684	2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	31
PID 2180 wrote to memory of 1684	2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	31
PID 2180 wrote to memory of 1684	2180	8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe	31
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 1684 wrote to memory of 968	1684	omsecor.exe	32
PID 968 wrote to memory of 1384	968	omsecor.exe	35
PID 968 wrote to memory of 1384	968	omsecor.exe	35
PID 968 wrote to memory of 1384	968	omsecor.exe	35
PID 968 wrote to memory of 1384	968	omsecor.exe	35
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 1384 wrote to memory of 2012	1384	omsecor.exe	36
PID 2012 wrote to memory of 1744	2012	omsecor.exe	37
PID 2012 wrote to memory of 1744	2012	omsecor.exe	37
PID 2012 wrote to memory of 1744	2012	omsecor.exe	37
PID 2012 wrote to memory of 1744	2012	omsecor.exe	37
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38
PID 1744 wrote to memory of 2924	1744	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
"C:\Users\Admin\AppData\Local\Temp\8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
  C:\Users\Admin\AppData\Local\Temp\8d164879ff511843de723f8e0198d1f46055367257e454631e46d26523434cdf.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:968
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b0391407456bd3ae11e00360df2dc510

SHA1
57cf7efedacb72958911a4aad1a4f246c7184138

SHA256
bfbff077fea0e92f8f69e16cae3074a5ddc0763ca30e7069f3f9cfe5c2aa95cf

SHA512
2dfff7016bfb848855a8a03d18f549ce796078e0debc429cb4312f11b2edaf7d1208b2fa0ba2daa74cb02b5b36c7b14719f89d73ec7229fedc9b67da85e13597

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
293f08e8ee83c78bed68439b01f3e7f8

SHA1
d4db2e7efb3e7dff3a71d3126aa436cfc69aa821

SHA256
2287a9ef5c749d48ebc7cd7ece27343045e497b93228fbcc0674c86dbc4eabdb

SHA512
8582b87754cc39470fae19298d92762e24e8dc17f9b58a28b4ab847170c189ab5e1a9b72b1c0bed21784b6cac9c12d42ce4e4ac9f358aa7932e6513c76bc809e

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
8a1f799ef80bfad0c320354b4380595c

SHA1
9ae43db974f6088e6d22816e18949f347e42dd3e

SHA256
ee1a75e98b1ffdb45463411ac5c19e7007ffaa731fe8d9c145e10de780237199

SHA512
91a236779d2fad34d3a7034da22fcbd55a72220e42f23f77e7a77080efdfd70a302eaa121c50b75757d74b88a44206f70f081c1e74382d518005c2b663616238

Download Submit
memory/968-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/968-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/968-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/968-48-0x0000000000370000-0x0000000000393000-memory.dmp

Filesize
140KB

Download
memory/968-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/968-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1384-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1684-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1684-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1744-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2012-72-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2128-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2128-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2180-20-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2180-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2180-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2180-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2180-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2180-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2180-14-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2924-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download