neconyd | b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
Size

96KB
MD5

f32c665675cc7dfbdf396e2a42ab7b9d
SHA1

3f8c1914d341888bc3c235908ab773c3f71e8801
SHA256

b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643
SHA512

ff3a11632dac72174f494e1be17c42b29bc5ae71305b19aca6e20dc9ffd18491796bcf5b181e5e1b918cd06c7423cd942237367958c6145eda5252a452197978
SSDEEP

1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:UGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2360	omsecor.exe
3924	omsecor.exe
4904	omsecor.exe
3808	omsecor.exe
1152	omsecor.exe
3988	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 2360 set thread context of 3924	2360	omsecor.exe	87
PID 4904 set thread context of 3808	4904	omsecor.exe	100
PID 1152 set thread context of 3988	1152	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3416	1116	WerFault.exe	81
4284	2360	WerFault.exe	85
556	4904	WerFault.exe	99
2332	1152	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 1116 wrote to memory of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 1116 wrote to memory of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 1116 wrote to memory of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 1116 wrote to memory of 3132	1116	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	82
PID 3132 wrote to memory of 2360	3132	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	85
PID 3132 wrote to memory of 2360	3132	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	85
PID 3132 wrote to memory of 2360	3132	b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe	85
PID 2360 wrote to memory of 3924	2360	omsecor.exe	87
PID 2360 wrote to memory of 3924	2360	omsecor.exe	87
PID 2360 wrote to memory of 3924	2360	omsecor.exe	87
PID 2360 wrote to memory of 3924	2360	omsecor.exe	87
PID 2360 wrote to memory of 3924	2360	omsecor.exe	87
PID 3924 wrote to memory of 4904	3924	omsecor.exe	99
PID 3924 wrote to memory of 4904	3924	omsecor.exe	99
PID 3924 wrote to memory of 4904	3924	omsecor.exe	99
PID 4904 wrote to memory of 3808	4904	omsecor.exe	100
PID 4904 wrote to memory of 3808	4904	omsecor.exe	100
PID 4904 wrote to memory of 3808	4904	omsecor.exe	100
PID 4904 wrote to memory of 3808	4904	omsecor.exe	100
PID 4904 wrote to memory of 3808	4904	omsecor.exe	100
PID 3808 wrote to memory of 1152	3808	omsecor.exe	102
PID 3808 wrote to memory of 1152	3808	omsecor.exe	102
PID 3808 wrote to memory of 1152	3808	omsecor.exe	102
PID 1152 wrote to memory of 3988	1152	omsecor.exe	104
PID 1152 wrote to memory of 3988	1152	omsecor.exe	104
PID 1152 wrote to memory of 3988	1152	omsecor.exe	104
PID 1152 wrote to memory of 3988	1152	omsecor.exe	104
PID 1152 wrote to memory of 3988	1152	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
"C:\Users\Admin\AppData\Local\Temp\b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
  C:\Users\Admin\AppData\Local\Temp\b969c47de04d42b30a8600b2e21e69da37311cf899c90f524c04e9b5ee2cf643.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4904
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 256
        8⤵
        Program crash
        
        PID:2332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 292
        6⤵
        Program crash
        
        PID:556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 288
      4⤵
      Program crash
      PID:4284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 288
  2⤵
  - Program crash
  PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1116 -ip 1116
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2360 -ip 2360
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4904 -ip 4904
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1152 -ip 1152
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
457aa849222397dd26d77f234974a848

SHA1
6c0c5f1f40151b21c1e0c75340c233d5eecc6732

SHA256
60fc59e7b0407b02d22be8af36b43a5b4258da550771dcfe117d9e90bb790d7d

SHA512
a43150cf414e3525cdc89c0f6d976c292c9d48a2f5e6dca1e0c045627eeae3f3d6fe8482ed65983f38f6569b597ec275b4c7681ed89424e3b92ff306b97885d3

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
70a2cc67fee7dc5cf0c331893892132b

SHA1
80d8de990992aafeb1ec45667100cd28b52f8d08

SHA256
9d7cb85a639326e7cb771fbb62a5f4f60767d5408cdf3c85f3200cbe315d8657

SHA512
c24da7c2731bc2482867083467146b6b8e54bb18e351bf2ddf93a6efea2051c7fee79e474c60d665e03e8d2d479ac4fdc9ff36f2711b10ffa8aec47ff5783eca

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
ee73d8f676f031aa7f0786e3bb03a045

SHA1
a61df0cc4f600ad00b948cab7c32d3e65aaddb31

SHA256
47d92cc5e2daeea618cb5207a8859e062cfa3c0806a11fa912650dcb6ec7ef90

SHA512
489823b223973b9710448e4ea3b0e4ca81ee194fb05cb35bbb74b4377f72ba7cc75767bd597959c15785613679697d5cef612c8ac1e7d696c245dff85000695a

Download Submit
memory/1116-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1116-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1152-43-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1152-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2360-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2360-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3132-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3132-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3132-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3132-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3808-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3808-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3808-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3924-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3988-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3988-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3988-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3988-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4904-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4904-51-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download