General

  • Target

    4d7fe88e069cfa1dacd38b920c414fc0N.exe

  • Size

    134KB

  • Sample

    240819-xlsx4avajp

  • MD5

    4d7fe88e069cfa1dacd38b920c414fc0

  • SHA1

    f0e98b1af5906a6a8052c3efd53162f1b3ec72bd

  • SHA256

    b76bc0915d14a83a1d53df78a3e3ff3c7b281742051d32788c5f0c8b77c90f78

  • SHA512

    9b0ce095b38962fe061a0c6d3e836fc60b169dea084c0bafcf5327e75ea28660fd145fee6409df35b73801563e678c63270e55489647f03dc715cc8c9006d9a7

  • SSDEEP

    1536:hDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:BiRTeH0NqAW6J6f1tqF6dngNmaZC7M

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      4d7fe88e069cfa1dacd38b920c414fc0N.exe

    • Size

      134KB

    • MD5

      4d7fe88e069cfa1dacd38b920c414fc0

    • SHA1

      f0e98b1af5906a6a8052c3efd53162f1b3ec72bd

    • SHA256

      b76bc0915d14a83a1d53df78a3e3ff3c7b281742051d32788c5f0c8b77c90f78

    • SHA512

      9b0ce095b38962fe061a0c6d3e836fc60b169dea084c0bafcf5327e75ea28660fd145fee6409df35b73801563e678c63270e55489647f03dc715cc8c9006d9a7

    • SSDEEP

      1536:hDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:BiRTeH0NqAW6J6f1tqF6dngNmaZC7M

    • Neconyd

      Neconyd is a trojan written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks