neconyd | 644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Size

134KB
MD5

db4096d708ae42fa2a1ab53cd97147e4
SHA1

77ca3ab0ce433f948db8e9f741109d4fea005f99
SHA256

644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9
SHA512

08ddf0da7f5e01facc945dae786298dd100d56859826261c0b83bc4b56c270dfc40f24ac349a620f91584c993b7a2c8537209c8ccffa2036ca7e972dd87c3587
SSDEEP

1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi9:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1668	omsecor.exe
1976	omsecor.exe
536	omsecor.exe
2732	omsecor.exe
1880	omsecor.exe
2428	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
1668	omsecor.exe
1976	omsecor.exe
1976	omsecor.exe
2732	omsecor.exe
2732	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 1668 set thread context of 1976	1668	omsecor.exe	32
PID 536 set thread context of 2732	536	omsecor.exe	36
PID 1880 set thread context of 2428	1880	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2064 wrote to memory of 2576	2064	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	30
PID 2576 wrote to memory of 1668	2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	31
PID 2576 wrote to memory of 1668	2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	31
PID 2576 wrote to memory of 1668	2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	31
PID 2576 wrote to memory of 1668	2576	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	31
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1668 wrote to memory of 1976	1668	omsecor.exe	32
PID 1976 wrote to memory of 536	1976	omsecor.exe	35
PID 1976 wrote to memory of 536	1976	omsecor.exe	35
PID 1976 wrote to memory of 536	1976	omsecor.exe	35
PID 1976 wrote to memory of 536	1976	omsecor.exe	35
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 536 wrote to memory of 2732	536	omsecor.exe	36
PID 2732 wrote to memory of 1880	2732	omsecor.exe	37
PID 2732 wrote to memory of 1880	2732	omsecor.exe	37
PID 2732 wrote to memory of 1880	2732	omsecor.exe	37
PID 2732 wrote to memory of 1880	2732	omsecor.exe	37
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38
PID 1880 wrote to memory of 2428	1880	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
"C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
  C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:536
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
31dd7df15059cbf9f29c92f5e47045c3

SHA1
8e26a5a4fa11416ee18e566ccba5425d1bb62a29

SHA256
2f008235d25acaf214429e72f6d18b75f3621d6bf0ca358f57d338da2f8f804a

SHA512
c63b114147c58943c5b5dfb941db14b268b93d0e9d66824f9bd8792a32a3e43dd8c60a8fec53f2e738375afe0aff50dfdbacd468bf5a80360e1b371325251844

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
9843fdb425406358265410451bc3659c

SHA1
cd560c41845c5e404a2d9416efccd55083189c4f

SHA256
4166947a5403b07b9578283297260fcf393362dc01b74c13458cb42fb62240b1

SHA512
dfc53fcb017b6a2a68a82bcaa311f9cb57806dd055f3b35a378e776d02047d6ffa6a7f9f0752417553cc63315cf0a0b6c42862b42703343b5727851f6dfb2b18

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
643d61ea630457a46a1e416a1f114729

SHA1
9b088969cb75a2fe70b9d2085aa7744f7f2ef8a2

SHA256
137f68c1d8c48f66d06f005687675a7ea82b6f03887f7b5eb5513dd7db1aab84

SHA512
4e61bdd38d3831b989eb0e67899b1e17a6bbeeccc28f2ce9e4ba0c8e5d14569fcd4ab504ae4d6cc71685ee64b96cdd50c965e498d5bb4a0aabb5699cc9d77b0b

Download Submit
memory/536-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/536-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1668-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1668-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1668-23-0x0000000000270000-0x0000000000294000-memory.dmp

Filesize
144KB

Download
memory/1880-82-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1976-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2064-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2428-84-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-67-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download