neconyd | 62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
Size

134KB
MD5

51dad8da4937b0553e89916281ade2a0
SHA1

750688fe6ba6efd508f34275a8a1584d20ff97e8
SHA256

62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33
SHA512

6fb2f41cf9db6176f47430c190e08bcacd9dae64e5865ba062e703fda17003ee22f45b96200a265fec6e16ad311ce051728bb9118e2ca62842127ce04c4ca677
SSDEEP

1536:cDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:CiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3020	omsecor.exe
1788	omsecor.exe
540	omsecor.exe
2032	omsecor.exe
2796	omsecor.exe
272	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
3020	omsecor.exe
1788	omsecor.exe
1788	omsecor.exe
2032	omsecor.exe
2032	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 3020 set thread context of 1788	3020	omsecor.exe	33
PID 540 set thread context of 2032	540	omsecor.exe	37
PID 2796 set thread context of 272	2796	omsecor.exe	39

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2316 wrote to memory of 2932	2316	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	31
PID 2932 wrote to memory of 3020	2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	32
PID 2932 wrote to memory of 3020	2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	32
PID 2932 wrote to memory of 3020	2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	32
PID 2932 wrote to memory of 3020	2932	62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe	32
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 3020 wrote to memory of 1788	3020	omsecor.exe	33
PID 1788 wrote to memory of 540	1788	omsecor.exe	36
PID 1788 wrote to memory of 540	1788	omsecor.exe	36
PID 1788 wrote to memory of 540	1788	omsecor.exe	36
PID 1788 wrote to memory of 540	1788	omsecor.exe	36
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 540 wrote to memory of 2032	540	omsecor.exe	37
PID 2032 wrote to memory of 2796	2032	omsecor.exe	38
PID 2032 wrote to memory of 2796	2032	omsecor.exe	38
PID 2032 wrote to memory of 2796	2032	omsecor.exe	38
PID 2032 wrote to memory of 2796	2032	omsecor.exe	38
PID 2796 wrote to memory of 272	2796	omsecor.exe	39
PID 2796 wrote to memory of 272	2796	omsecor.exe	39
PID 2796 wrote to memory of 272	2796	omsecor.exe	39
PID 2796 wrote to memory of 272	2796	omsecor.exe	39
PID 2796 wrote to memory of 272	2796	omsecor.exe	39
PID 2796 wrote to memory of 272	2796	omsecor.exe	39

C:\Users\Admin\AppData\Local\Temp\62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
"C:\Users\Admin\AppData\Local\Temp\62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
  C:\Users\Admin\AppData\Local\Temp\62ac3574bd12cc74abfd717ae484ff082cbf287eb5c3ced887bd5f5abc22fe33N.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
334fb6c9dd7c59479d87391e23ebb955

SHA1
97b593e659f225767742a4f3eea7fb3698c3e48e

SHA256
28f651661348768852a846f00be5a451a6ddbd62e4217fadccd704daa159192c

SHA512
759bc98c6559a937438ca3150de5375398e4703c77793153dce5c10216e54ac83ceefa1f9e7bf4399ddc3ed04407f336f471fce40b70a36386ad9d65c1ee2e91

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
191f3c5b16b76f0fcf3b23d5f77b1250

SHA1
bf5c7402e87ecfdf744953664e3d02debe8ce789

SHA256
a6ef84b7eeb07fb3c685d5733521cc68e7318d05e52e709da2d755c80295b792

SHA512
9da0fab44051211a9936fb8b815b5ed7a022088fb4a935f7c06b70b88b62b3802d3d629f813db1466e2785d7e17fdb971990d41a83753b8e7a3c1f2b7f890e6b

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
186835589f0e88fcc2e94b28a50a03fb

SHA1
b374ec30e1a23376dd1c3f6590cd75793b211320

SHA256
eca59997b5e954e1ff9c47ca15c2735fc72f9f8aa7cc044e24bc6025d52c97b9

SHA512
bdd3dcc601b1480c3c9c9aee8432b791583516816aa2756ad00fb325cf6f3cbb93d77c94b6dbc2f967cf26cfeec2b5aa865ca1082222ffcebac9cdf57a5b2444

Download Submit
memory/272-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/540-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/540-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1788-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-52-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1788-51-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/2032-87-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2032-77-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2316-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2316-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2796-78-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2796-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2932-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3020-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3020-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3020-23-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download