neconyd | 5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2025, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe
Size

90KB
MD5

cc222301a4a9b09492d78de247e590fa
SHA1

566fc3ff32d9fb77f4b3eaca91002ee7c287dc94
SHA256

5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a
SHA512

904862e067812a8f1a0d85876c97dbcc222884503b969e0ea1c5999a8bea5577688f02a6280785c9c42df9ee7df5ed298e0fa6affc54de6122ad27e88f0fdf85
SSDEEP

768:jMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uAu:jbIvYvZEyFKF6N4aS5AQmZTl/5m

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
4736	omsecor.exe
2792	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4736	3480	5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe	84
PID 3480 wrote to memory of 4736	3480	5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe	84
PID 3480 wrote to memory of 4736	3480	5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe	84
PID 4736 wrote to memory of 2792	4736	omsecor.exe	90
PID 4736 wrote to memory of 2792	4736	omsecor.exe	90
PID 4736 wrote to memory of 2792	4736	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe
"C:\Users\Admin\AppData\Local\Temp\5b68c337d18fabdb4e0b378783ee8c926d70ea6c43b0bebd0f8ee99ec51dd99a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
a6a1fcda1d378f15fd9310fe3ef2225a

SHA1
8ecd9fdc504072dac70d9bfae3010cda39ac5e09

SHA256
fe9b78e5539a35d7172b4532c3fdd03ce87da231e459e021e85d4cb7d9ca7f4b

SHA512
767595e525c532ef8cc21a2264428c143f2f455c93fcf8b112538eb953137dcf80ec976af5ba8ddb24f70a959c126b4b96cff6ae5343338aaa48b371deb3f6f8

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
c9d620bbf956b5b20a00e2955eee60f1

SHA1
2339f28de5cd3709dc4b91ca7ddcdcaf87ade4dd

SHA256
63af4ccff6d505e718df197f59153e75381cff5c4277eb5d9213c0ca898bb0fe

SHA512
32d4cf7cd137a0d0fa7ecea5f6ca07004f43c7ccc4d04dcab3bdfac6fab817a4803e4678f28ba29397c8398b39dff8725bb531951fe7f27c69f867af40e9d9aa

Download Submit
memory/2792-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2792-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3480-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3480-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4736-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4736-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4736-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download