neconyd | 00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
Size

134KB
MD5

17abba9b7903c73f47d031d6a7ca2973
SHA1

054397fba61cb951cb8cac20adada39cf4c0d3f6
SHA256

00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4
SHA512

c4513e79cd8b9f162245348e410120dbdb725f71d2971d0a645ad0fc93b132f1211a3e8ae4f5bff52c7a8cead5f94af4cd8abc0a120770a081fab31a30400e28
SSDEEP

1536:FDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiX:liRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1584	omsecor.exe
1012	omsecor.exe
1816	omsecor.exe
700	omsecor.exe
3636	omsecor.exe
216	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 1584 set thread context of 1012	1584	omsecor.exe	89
PID 1816 set thread context of 700	1816	omsecor.exe	99
PID 3636 set thread context of 216	3636	omsecor.exe	103

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3248	1584	WerFault.exe	87
1672	2672	WerFault.exe	82
5092	1816	WerFault.exe	98
3200	3636	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 2672 wrote to memory of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 2672 wrote to memory of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 2672 wrote to memory of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 2672 wrote to memory of 1952	2672	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	84
PID 1952 wrote to memory of 1584	1952	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	87
PID 1952 wrote to memory of 1584	1952	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	87
PID 1952 wrote to memory of 1584	1952	00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe	87
PID 1584 wrote to memory of 1012	1584	omsecor.exe	89
PID 1584 wrote to memory of 1012	1584	omsecor.exe	89
PID 1584 wrote to memory of 1012	1584	omsecor.exe	89
PID 1584 wrote to memory of 1012	1584	omsecor.exe	89
PID 1584 wrote to memory of 1012	1584	omsecor.exe	89
PID 1012 wrote to memory of 1816	1012	omsecor.exe	98
PID 1012 wrote to memory of 1816	1012	omsecor.exe	98
PID 1012 wrote to memory of 1816	1012	omsecor.exe	98
PID 1816 wrote to memory of 700	1816	omsecor.exe	99
PID 1816 wrote to memory of 700	1816	omsecor.exe	99
PID 1816 wrote to memory of 700	1816	omsecor.exe	99
PID 1816 wrote to memory of 700	1816	omsecor.exe	99
PID 1816 wrote to memory of 700	1816	omsecor.exe	99
PID 700 wrote to memory of 3636	700	omsecor.exe	101
PID 700 wrote to memory of 3636	700	omsecor.exe	101
PID 700 wrote to memory of 3636	700	omsecor.exe	101
PID 3636 wrote to memory of 216	3636	omsecor.exe	103
PID 3636 wrote to memory of 216	3636	omsecor.exe	103
PID 3636 wrote to memory of 216	3636	omsecor.exe	103
PID 3636 wrote to memory of 216	3636	omsecor.exe	103
PID 3636 wrote to memory of 216	3636	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
"C:\Users\Admin\AppData\Local\Temp\00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
  C:\Users\Admin\AppData\Local\Temp\00700fd8f51e7e4a3347522e3d5698c1a326441fe0dd0fce00cdc30c161d02e4.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1816
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 264
        8⤵
        Program crash
        
        PID:3200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 304
        6⤵
        Program crash
        
        PID:5092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 288
      4⤵
      Program crash
      PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 288
  2⤵
  - Program crash
  PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2672 -ip 2672
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1584 -ip 1584
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1816 -ip 1816
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3636 -ip 3636
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
f12dbc220a90f9e2d2ad8303e5ecdf8f

SHA1
080e72badfb81e725ac3e52a56631f35b7f19505

SHA256
033c2a7eaf3e01e3a5cfdb858472fae641a5c0467b5573e31228a54484d2ad3f

SHA512
932fbb6ad2a17125f8566ac4e9ab9f7fa4aea9e8d5805b73232272f8608604f7d9ddbb22d1c18b717868242da6fe4908218d7b039c4eeeaefeea14a63d85bd8e

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e002099a6c2a068f3aeb96bf7021d0ee

SHA1
de323371dd59a1d713798853fdce088046c194bd

SHA256
ed4fec053ec90719eb3310f9d68089608bd7998e7d61a9d51214a2e6608ee31f

SHA512
b60ad82ec3bc1363e3f1b1a8a461e9f752394052f981c4afb46fb4fe7f119d0fddbcd13c8a27f266aba783de887e0ea11f436e24fe786825b50723ce0ae7556e

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
bac5ccd1c6c0702f4947753efee8fb66

SHA1
9134988f22f7ad7bf126c16856b4a7208f67541b

SHA256
9792d4b521fa40b47f5f3efd4f74f53f3096520564a9ea6aced9cca4078b9bfa

SHA512
33a0ebf73f748f441b53f8b81b19866850fdcaf2aa75d2931d7be29642140ec3257b22fa4a3941db02f019e1c91546ba2bfb67666108d99f014502956e40954f

Download Submit
memory/216-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/216-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/216-46-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/216-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/700-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/700-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/700-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1584-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1816-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1952-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2672-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2672-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3636-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download