neconyd | 644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Size

134KB
MD5

db4096d708ae42fa2a1ab53cd97147e4
SHA1

77ca3ab0ce433f948db8e9f741109d4fea005f99
SHA256

644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9
SHA512

08ddf0da7f5e01facc945dae786298dd100d56859826261c0b83bc4b56c270dfc40f24ac349a620f91584c993b7a2c8537209c8ccffa2036ca7e972dd87c3587
SSDEEP

1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi9:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
540	omsecor.exe
4188	omsecor.exe
4948	omsecor.exe
5104	omsecor.exe
2852	omsecor.exe
4984	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 540 set thread context of 4188	540	omsecor.exe	89
PID 4948 set thread context of 5104	4948	omsecor.exe	98
PID 2852 set thread context of 4984	2852	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1524	2840	WerFault.exe	82
5088	540	WerFault.exe	86
3688	4948	WerFault.exe	97
3904	2852	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 2840 wrote to memory of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 2840 wrote to memory of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 2840 wrote to memory of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 2840 wrote to memory of 3760	2840	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	84
PID 3760 wrote to memory of 540	3760	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	86
PID 3760 wrote to memory of 540	3760	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	86
PID 3760 wrote to memory of 540	3760	644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe	86
PID 540 wrote to memory of 4188	540	omsecor.exe	89
PID 540 wrote to memory of 4188	540	omsecor.exe	89
PID 540 wrote to memory of 4188	540	omsecor.exe	89
PID 540 wrote to memory of 4188	540	omsecor.exe	89
PID 540 wrote to memory of 4188	540	omsecor.exe	89
PID 4188 wrote to memory of 4948	4188	omsecor.exe	97
PID 4188 wrote to memory of 4948	4188	omsecor.exe	97
PID 4188 wrote to memory of 4948	4188	omsecor.exe	97
PID 4948 wrote to memory of 5104	4948	omsecor.exe	98
PID 4948 wrote to memory of 5104	4948	omsecor.exe	98
PID 4948 wrote to memory of 5104	4948	omsecor.exe	98
PID 4948 wrote to memory of 5104	4948	omsecor.exe	98
PID 4948 wrote to memory of 5104	4948	omsecor.exe	98
PID 5104 wrote to memory of 2852	5104	omsecor.exe	100
PID 5104 wrote to memory of 2852	5104	omsecor.exe	100
PID 5104 wrote to memory of 2852	5104	omsecor.exe	100
PID 2852 wrote to memory of 4984	2852	omsecor.exe	102
PID 2852 wrote to memory of 4984	2852	omsecor.exe	102
PID 2852 wrote to memory of 4984	2852	omsecor.exe	102
PID 2852 wrote to memory of 4984	2852	omsecor.exe	102
PID 2852 wrote to memory of 4984	2852	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
"C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
  C:\Users\Admin\AppData\Local\Temp\644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4948
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 188
        8⤵
        Program crash
        
        PID:3904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 292
        6⤵
        Program crash
        
        PID:3688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 300
      4⤵
      Program crash
      PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 288
  2⤵
  - Program crash
  PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2840 -ip 2840
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 540 -ip 540
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4948 -ip 4948
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2852 -ip 2852
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
7a635f92e68950b8a852e85faace7c03

SHA1
52d89952a0aa3fabbb6f4509c2371e1313572997

SHA256
5c540fcf0539773082eeca383f1953f14af119f3e5dfce84ede984d47b6b6232

SHA512
050e495078ac44e725b9b9eaf91d4359896d382ff3a4ef8078bebc851d02f3f76f7a4075f3f98c20408c098044541db090f5ac2c9f09aeb200f2fbdfd4be6497

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
31dd7df15059cbf9f29c92f5e47045c3

SHA1
8e26a5a4fa11416ee18e566ccba5425d1bb62a29

SHA256
2f008235d25acaf214429e72f6d18b75f3621d6bf0ca358f57d338da2f8f804a

SHA512
c63b114147c58943c5b5dfb941db14b268b93d0e9d66824f9bd8792a32a3e43dd8c60a8fec53f2e738375afe0aff50dfdbacd468bf5a80360e1b371325251844

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
4ae6ef23d7b40527f3033f81abe46af5

SHA1
2a46cd68bdf50619bd9f72fed0ac58fec4958040

SHA256
9e239f11de4a368c56e3fbdfe989d83a476952f8c0d2058bfcda8b79d8f1a5af

SHA512
46db544a33c0e8110541799b0d4d58151ecd6e5d70b0ac723288c30ac25cd4ceb311643ef9d1f1d44ced813d9e002231339be438824d251dc2866949403035aa

Download Submit
memory/540-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/540-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2852-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2852-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3760-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3760-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3760-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3760-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4188-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4948-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4948-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4984-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4984-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4984-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5104-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5104-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5104-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download