neconyd | 7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2025 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Size

96KB
MD5

15505d5ae127e243511b2048e8c0054b
SHA1

31bbb70eb0d814f50115ed210747c84bf8ffbe53
SHA256

7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04
SHA512

83e7bf541bd0a9474bfa9f3375cb9b9f51839ed0617afcc8238cd1e0098f3c848ca3e2bcce2d74d8d7e60e18ef0e15e5b2490da20d341d71e90dc888b7363cfd
SSDEEP

1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxD:UGs8cd8eXlYairZYqMddH13D

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3376	omsecor.exe
3704	omsecor.exe
2704	omsecor.exe
1140	omsecor.exe
4884	omsecor.exe
516	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3376 set thread context of 3704	3376	omsecor.exe	87
PID 2704 set thread context of 1140	2704	omsecor.exe	98
PID 4884 set thread context of 516	4884	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3584	3760	WerFault.exe	82
896	3376	WerFault.exe	86
4300	2704	WerFault.exe	97
4780	4884	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3760 wrote to memory of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3760 wrote to memory of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3760 wrote to memory of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3760 wrote to memory of 3748	3760	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	83
PID 3748 wrote to memory of 3376	3748	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	86
PID 3748 wrote to memory of 3376	3748	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	86
PID 3748 wrote to memory of 3376	3748	7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe	86
PID 3376 wrote to memory of 3704	3376	omsecor.exe	87
PID 3376 wrote to memory of 3704	3376	omsecor.exe	87
PID 3376 wrote to memory of 3704	3376	omsecor.exe	87
PID 3376 wrote to memory of 3704	3376	omsecor.exe	87
PID 3376 wrote to memory of 3704	3376	omsecor.exe	87
PID 3704 wrote to memory of 2704	3704	omsecor.exe	97
PID 3704 wrote to memory of 2704	3704	omsecor.exe	97
PID 3704 wrote to memory of 2704	3704	omsecor.exe	97
PID 2704 wrote to memory of 1140	2704	omsecor.exe	98
PID 2704 wrote to memory of 1140	2704	omsecor.exe	98
PID 2704 wrote to memory of 1140	2704	omsecor.exe	98
PID 2704 wrote to memory of 1140	2704	omsecor.exe	98
PID 2704 wrote to memory of 1140	2704	omsecor.exe	98
PID 1140 wrote to memory of 4884	1140	omsecor.exe	100
PID 1140 wrote to memory of 4884	1140	omsecor.exe	100
PID 1140 wrote to memory of 4884	1140	omsecor.exe	100
PID 4884 wrote to memory of 516	4884	omsecor.exe	102
PID 4884 wrote to memory of 516	4884	omsecor.exe	102
PID 4884 wrote to memory of 516	4884	omsecor.exe	102
PID 4884 wrote to memory of 516	4884	omsecor.exe	102
PID 4884 wrote to memory of 516	4884	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
"C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
  C:\Users\Admin\AppData\Local\Temp\7ff2df5889a4cc7c1e24c7ae290ca37acf676e050eb140fabfcd948cf11cdb04.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2704
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 256
        8⤵
        Program crash
        
        PID:4780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 292
        6⤵
        Program crash
        
        PID:4300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 288
      4⤵
      Program crash
      PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 300
  2⤵
  - Program crash
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3760 -ip 3760
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3376 -ip 3376
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2704 -ip 2704
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4884 -ip 4884
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
cced6e3c6f9905bf73ff3d8d0b238211

SHA1
f1a67c166fdb61b4c2b5cba655e16753294e5810

SHA256
1c2fdfd1da0be3e67dbb0e1a82a8260cf6cee89b590d1f14d8d9afb1f8e5173f

SHA512
556bef831d105f99e01609da1916dcb56b403eca8ff02cfa7523a043a4b519c6f8c401d5e22c5b0546718dcfb8f2a0a2aa0fc8c6fb03336ed03619ab36b4dc27

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
851570457d745a94b248af5bf3c564cb

SHA1
06b698fccb9270a506316d4999291e40bebb47b1

SHA256
99fcd7fd3dd2d9c85f99caffd9e53c87dbf9b29a155430692a09afe9cd631e04

SHA512
d14891af925cded54a67db146594a4b605ee6fa0b02b64b92226f32c63fe47f4f9285c5d9943db86dda25efa66c2e9ba4b45b958f2f195ca3521eb28ec6544ac

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
93d4ab3117fb140f3f85f0d8c9fc9991

SHA1
825a62d371f026b96086b2a708158a3cf3dca068

SHA256
2a1d5de9b94de4aa2ed037dc9a8bdb52c11b50de8833478c8bf372bb64b64e9b

SHA512
136cbaeee5915e641043ccf9c8d1f608c1af9d40687b0f977d193166e9a26459a7ced246c4dc4ebddb14d2bf32935a78f879f6412468d4c36ab428f85ea70441

Download Submit
memory/516-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/516-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/516-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1140-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1140-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1140-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2704-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3376-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3376-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3704-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3704-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3760-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3760-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4884-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download