neconyd | 7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04

Analysis

max time kernel
116s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Size

96KB
MD5

15505d5ae127e243511b2048e8c0054b
SHA1

31bbb70eb0d814f50115ed210747c84bf8ffbe53
SHA256

7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04
SHA512

83e7bf541bd0a9474bfa9f3375cb9b9f51839ed0617afcc8238cd1e0098f3c848ca3e2bcce2d74d8d7e60e18ef0e15e5b2490da20d341d71e90dc888b7363cfd
SSDEEP

1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxD:UGs8cd8eXlYairZYqMddH13D

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2832	omsecor.exe
2828	omsecor.exe
576	omsecor.exe
2516	omsecor.exe
1264	omsecor.exe
2160	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
2832	omsecor.exe
2828	omsecor.exe
2828	omsecor.exe
2516	omsecor.exe
2516	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2832 set thread context of 2828	2832	omsecor.exe	32
PID 576 set thread context of 2516	576	omsecor.exe	36
PID 1264 set thread context of 2160	1264	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2880 wrote to memory of 2876	2880	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	30
PID 2876 wrote to memory of 2832	2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	31
PID 2876 wrote to memory of 2832	2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	31
PID 2876 wrote to memory of 2832	2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	31
PID 2876 wrote to memory of 2832	2876	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	31
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2832 wrote to memory of 2828	2832	omsecor.exe	32
PID 2828 wrote to memory of 576	2828	omsecor.exe	35
PID 2828 wrote to memory of 576	2828	omsecor.exe	35
PID 2828 wrote to memory of 576	2828	omsecor.exe	35
PID 2828 wrote to memory of 576	2828	omsecor.exe	35
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 576 wrote to memory of 2516	576	omsecor.exe	36
PID 2516 wrote to memory of 1264	2516	omsecor.exe	37
PID 2516 wrote to memory of 1264	2516	omsecor.exe	37
PID 2516 wrote to memory of 1264	2516	omsecor.exe	37
PID 2516 wrote to memory of 1264	2516	omsecor.exe	37
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38
PID 1264 wrote to memory of 2160	1264	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
"C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
  C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:576
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
851570457d745a94b248af5bf3c564cb

SHA1
06b698fccb9270a506316d4999291e40bebb47b1

SHA256
99fcd7fd3dd2d9c85f99caffd9e53c87dbf9b29a155430692a09afe9cd631e04

SHA512
d14891af925cded54a67db146594a4b605ee6fa0b02b64b92226f32c63fe47f4f9285c5d9943db86dda25efa66c2e9ba4b45b958f2f195ca3521eb28ec6544ac

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b06b65bd7ca8d49da44a74714b31e606

SHA1
fd2d9645884c563413e0c97e6ecf862a8e33058b

SHA256
672b91de544407580606f9828f71d9bade4eebfff460b99e26403142b4047fb1

SHA512
bede5ff7a52d77c4e58659aa9d16a609569a2e2e28b8869adb4685de3811dd9a65df02b7132a4b241c55d5b53ed954733eba91acc5d97d759b3598fe1a2aa8e7

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
2dc3f2a4e6e69aced53d212e3143b5a2

SHA1
4b60603d1904cc2cf80477bd2fe42fb87f638c75

SHA256
b9113ab7ec9dd1e0f4442dca964f8687843c048974f9ea0924830613940f1ee4

SHA512
42c0d9d035bb92d607bf406c7db8c310adfc4af27f38507fbcf79f8f638414760ba91d5753f7c889baffe11e4c6e4d7071abac495179ff4f60d36d8057090045

Download Submit
memory/576-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1264-82-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1264-90-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2160-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2516-74-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2828-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-50-0x0000000002030000-0x0000000002053000-memory.dmp

Filesize
140KB

Download
memory/2828-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2832-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2832-26-0x0000000000430000-0x0000000000453000-memory.dmp

Filesize
140KB

Download
memory/2832-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2876-37-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2876-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2876-21-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2876-14-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2876-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2876-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2876-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2876-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2880-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2880-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download