neconyd | 4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
Size

96KB
MD5

396e47fc5dbbce9771dd3775523d0c1c
SHA1

48a4015e038bbd575f3ed78d275053e2181b7d9f
SHA256

4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78
SHA512

f9ccadfa8a3aa606798dd265150cd2cd001ec5211e390626b84f3f6876236427cf42b9526c9383c13f1a8ccddb1f13ead46aeff3b1339b5678adaeb680f8c5fd
SSDEEP

1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxR:JGs8cd8eXlYairZYqMddH13R

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
984	omsecor.exe
2488	omsecor.exe
2532	omsecor.exe
1864	omsecor.exe
580	omsecor.exe
1968	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
984	omsecor.exe
2488	omsecor.exe
2488	omsecor.exe
1864	omsecor.exe
1864	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 984 set thread context of 2488	984	omsecor.exe	33
PID 2532 set thread context of 1864	2532	omsecor.exe	37
PID 580 set thread context of 1968	580	omsecor.exe	39

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 1812 wrote to memory of 2304	1812	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	31
PID 2304 wrote to memory of 984	2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	32
PID 2304 wrote to memory of 984	2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	32
PID 2304 wrote to memory of 984	2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	32
PID 2304 wrote to memory of 984	2304	4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe	32
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 984 wrote to memory of 2488	984	omsecor.exe	33
PID 2488 wrote to memory of 2532	2488	omsecor.exe	36
PID 2488 wrote to memory of 2532	2488	omsecor.exe	36
PID 2488 wrote to memory of 2532	2488	omsecor.exe	36
PID 2488 wrote to memory of 2532	2488	omsecor.exe	36
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 2532 wrote to memory of 1864	2532	omsecor.exe	37
PID 1864 wrote to memory of 580	1864	omsecor.exe	38
PID 1864 wrote to memory of 580	1864	omsecor.exe	38
PID 1864 wrote to memory of 580	1864	omsecor.exe	38
PID 1864 wrote to memory of 580	1864	omsecor.exe	38
PID 580 wrote to memory of 1968	580	omsecor.exe	39
PID 580 wrote to memory of 1968	580	omsecor.exe	39
PID 580 wrote to memory of 1968	580	omsecor.exe	39
PID 580 wrote to memory of 1968	580	omsecor.exe	39
PID 580 wrote to memory of 1968	580	omsecor.exe	39
PID 580 wrote to memory of 1968	580	omsecor.exe	39

C:\Users\Admin\AppData\Local\Temp\4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
"C:\Users\Admin\AppData\Local\Temp\4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
  C:\Users\Admin\AppData\Local\Temp\4d903b2dd7a4768a983bad3b1a0ed133bf9fcd4edac3d64a332a506fa8e5aa78.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2532
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:580
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5fe23d076e7ad263a3a3b3531191ebdd

SHA1
466e2158f24b9d5e653426b6b1bbbcb46754e3e4

SHA256
948b08473d83bdcc320037da1297519c13b294b812a42ed8de6a0e9eab1017ca

SHA512
90102334a4fc8eea77449748672be9f1399b1d315a9565e35b9f3a59a8bb2a19fb549d036f7170b35b45d40a9b8b922dff6c8ce1909b77558ec4b9ab2fda16e5

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
3586781cb1607248a98e6dfc5bd47d4a

SHA1
9d8eb340dd8b62a2e36b6fec194a681961df18df

SHA256
6cc841797f74789cb7553cc908ef596f990d3088c81c7ad75cd988f71e10ee32

SHA512
41aa96a138ae807c45d68e505279c1f4cf5e8b2afeb2acc4080d4549199113b830690eb8e74e57a706a632ce5cb921a831a12417393e99986a702f643051a9e1

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
15fa3025b0fcc9ac852a160243918cd4

SHA1
58607066aff366ed21e414b42d7595d606400206

SHA256
f9e28d82f1dae1c9cc3513d5b5139efbf030a665e63cf0fb58f45dc57528e72d

SHA512
7dc6485fff08dcc659948032703460d6855a6e432c42cce057d4a4fd3e24161b9d1350af21806e4a81722890a980babdd52ce37cb1c6f251b9edf560e53a267f

Download Submit
memory/580-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/580-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/984-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/984-24-0x0000000000270000-0x0000000000293000-memory.dmp

Filesize
140KB

Download
memory/984-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1812-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1812-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1968-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1968-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2488-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2488-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2488-54-0x0000000000310000-0x0000000000333000-memory.dmp

Filesize
140KB

Download
memory/2488-53-0x0000000000310000-0x0000000000333000-memory.dmp

Filesize
140KB

Download
memory/2488-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2488-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2488-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download