neconyd | dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b

Analysis

max time kernel
116s
max time network
120s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
Size

96KB
MD5

42939f6d36616455ed6b192023e46298
SHA1

a11a300473c0ebb1029157676f82066879fa9d63
SHA256

dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b
SHA512

901f271293e63035ad26ee291fc9d9da6e46471901f982da228e886fc19669590b213d12ccb1a435cce0fe3f55432a390185c6c829c341633ecb73eb09c65996
SSDEEP

1536:DnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxZ:DGs8cd8eXlYairZYqMddH13Z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2396	omsecor.exe
484	omsecor.exe
1764	omsecor.exe
3016	omsecor.exe
1916	omsecor.exe
2316	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
2396	omsecor.exe
484	omsecor.exe
484	omsecor.exe
3016	omsecor.exe
3016	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2396 set thread context of 484	2396	omsecor.exe	32
PID 1764 set thread context of 3016	1764	omsecor.exe	36
PID 1916 set thread context of 2316	1916	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 2072 wrote to memory of 1520	2072	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	30
PID 1520 wrote to memory of 2396	1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	31
PID 1520 wrote to memory of 2396	1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	31
PID 1520 wrote to memory of 2396	1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	31
PID 1520 wrote to memory of 2396	1520	dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe	31
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 2396 wrote to memory of 484	2396	omsecor.exe	32
PID 484 wrote to memory of 1764	484	omsecor.exe	35
PID 484 wrote to memory of 1764	484	omsecor.exe	35
PID 484 wrote to memory of 1764	484	omsecor.exe	35
PID 484 wrote to memory of 1764	484	omsecor.exe	35
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 1764 wrote to memory of 3016	1764	omsecor.exe	36
PID 3016 wrote to memory of 1916	3016	omsecor.exe	37
PID 3016 wrote to memory of 1916	3016	omsecor.exe	37
PID 3016 wrote to memory of 1916	3016	omsecor.exe	37
PID 3016 wrote to memory of 1916	3016	omsecor.exe	37
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38
PID 1916 wrote to memory of 2316	1916	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
"C:\Users\Admin\AppData\Local\Temp\dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
  C:\Users\Admin\AppData\Local\Temp\dd2643e243a2b100d23002604a1c5f5ee2a88665930628a6b46571cbd3d5544b.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:484
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
3f54e81ea5e524dc3336742fb5a5622b

SHA1
1d0c3e111a2a6802f88e4edcbd056b3a7d8040ff

SHA256
69532e541672e3ee1e71007037ac0e083a01a87cc6b56266c53289d3a6fb5672

SHA512
ae3c483fa6adf05c335b0b24d86eec351b773540a7669e9d39f3713b4ec48f505dae838d6c08399f4089917d8355da2828aa88aec20e7b33bc1ad5207354966b

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
4761e458b4c37e85c25ec70ef8125d12

SHA1
a7a759dd5095c2427786b7373dd112fb4c2472e4

SHA256
0614cccf84fd15f8a12a3615d558b39db9fae5bbd935129f1b833bc3f2a9ea06

SHA512
81258f39e3f34f0d8f6d5455a9e977dbe0aa836fd89f060aa4366e7add5812ae633927de19664a312be4304cbb097104edb2f12439b05e667febe6495998e0ba

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
6003c30982bf404e223fc1a664b890a6

SHA1
4eb1f99a722af6ebb31102a4bfb16cc18d45a246

SHA256
b651d9778c55d25f92a8245a65ed97a6a65f7bec35bc1fbd5b80a3ea4af764e9

SHA512
f1c67679cae54bfe488423764d42c17826b904e4ec20278d9e8722e6b1b274e3cfb02ddddc8d9bba0b0f94f1688c7f045b3b126429902a13ba316e4cb466517e

Download Submit
memory/484-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/484-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/484-47-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/484-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/484-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/484-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1520-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1520-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1520-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1520-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1520-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1764-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1764-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1916-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1916-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2072-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2072-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2316-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2396-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2396-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3016-71-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/3016-75-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download