neconyd | cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
Size

96KB
MD5

7b36c6a0efbe6cc7449596ed82e309cd
SHA1

e935b2fc7675a6d9769311b8fe2ab4712d32f3bf
SHA256

cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a
SHA512

9d0592be95baecff12af33105fbdecc0c58da96b7ea28bd947f9a7731f2bd8ef709bb285477641128c27308e4f5ae64dbfa6ae9971f1c522966351810dba5239
SSDEEP

1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx5:OGs8cd8eXlYairZYqMddH135

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2836	omsecor.exe
2216	omsecor.exe
484	omsecor.exe
1964	omsecor.exe
2356	omsecor.exe
1996	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
2836	omsecor.exe
2216	omsecor.exe
2216	omsecor.exe
1964	omsecor.exe
1964	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2836 set thread context of 2216	2836	omsecor.exe	32
PID 484 set thread context of 1964	484	omsecor.exe	36
PID 2356 set thread context of 1996	2356	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2268 wrote to memory of 2724	2268	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	30
PID 2724 wrote to memory of 2836	2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	31
PID 2724 wrote to memory of 2836	2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	31
PID 2724 wrote to memory of 2836	2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	31
PID 2724 wrote to memory of 2836	2724	cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe	31
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2836 wrote to memory of 2216	2836	omsecor.exe	32
PID 2216 wrote to memory of 484	2216	omsecor.exe	35
PID 2216 wrote to memory of 484	2216	omsecor.exe	35
PID 2216 wrote to memory of 484	2216	omsecor.exe	35
PID 2216 wrote to memory of 484	2216	omsecor.exe	35
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 484 wrote to memory of 1964	484	omsecor.exe	36
PID 1964 wrote to memory of 2356	1964	omsecor.exe	37
PID 1964 wrote to memory of 2356	1964	omsecor.exe	37
PID 1964 wrote to memory of 2356	1964	omsecor.exe	37
PID 1964 wrote to memory of 2356	1964	omsecor.exe	37
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38
PID 2356 wrote to memory of 1996	2356	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
"C:\Users\Admin\AppData\Local\Temp\cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
  C:\Users\Admin\AppData\Local\Temp\cbd9a43b62486c673d03b1460839a152479747e7221e114a7d1570744728cc5a.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:484
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
552f63b7af00fbe5784371af1ed49515

SHA1
874e8f1185186679ad26e36e87595f86ad897f07

SHA256
6e162b9ff2cf40f0cff347694034b97f3540c7dff43bb45cc18f5a1e96fa5860

SHA512
ba375970b2f351cfe6c7201f72b6af4f8a8176844bb2067adb49fd288a816819a37b2b4a7d21b3cdb94f2b251a21347b09ebf8a087133e134d060ab3b294ab9a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
c48872a1822f9ab4e116785693b6726e

SHA1
ab3ecc4f0c5e75818f2554bf1816d748f307ce3b

SHA256
e5d5604c4468803c4a6da3ad1d80a2c1e09f119b7980bcf6bacd5d90e91272fb

SHA512
29041d8f57ee099b60551447fcbe7ff9836e7ea89f655680da298a2a78cec2478d8095239a07e8c43dabb1a5148a0ae8d37cd987bddc15d4fb3dc024e3520369

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
8d7f0986db67cb60bfd30cc0654fefb4

SHA1
a59b93bfd2678d70dc9b900bda5a923e7e198d74

SHA256
3d7d6c44a806420808f8b89c861b08b13c35a98e59d4eaf48b337c81fd151ecc

SHA512
4744f2fdbe6a9b28f76134485cbab1d9822d2d08b552c65f6e4e7a7a3aa6714dafd85323ca08b9fa2d0e27dbee350bc6be7252f1b2645f992ab51d2eddf7adbf

Download Submit
memory/484-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1964-72-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/1996-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1996-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2216-48-0x0000000002800000-0x0000000002823000-memory.dmp

Filesize
140KB

Download
memory/2268-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2268-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2268-35-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2356-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2356-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2724-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2724-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2724-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2724-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2836-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2836-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2836-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download