neconyd | 188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11

General

Target

188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
Size

134KB
MD5

8cbf9a04303c70dc701f19f449e73534
SHA1

3d3f8804fbb281f1e2e255869737a487ab36058e
SHA256

188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11
SHA512

cba21f08e4ba60184ffe026f2c04b99589226d79ee04d2469e9c835b29578c8e0681d5cf187451155f4d31207b0173076e5839ffcadaa134b4ba2a93376700f8
SSDEEP

1536:MDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:yiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 6 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exeomsecor.exeomsecor.exeomsecor.exe

pid process

1708 omsecor.exe
1724 omsecor.exe
2892 omsecor.exe
1284 omsecor.exe
1756 omsecor.exe
1952 omsecor.exe

pid	process
1708	omsecor.exe
1724	omsecor.exe
2892	omsecor.exe
1284	omsecor.exe
1756	omsecor.exe
1952	omsecor.exe

Loads dropped DLL 7 IoCs

Processes:

188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exeomsecor.exeomsecor.exeomsecor.exe

pid	process
2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
1708	omsecor.exe
1724	omsecor.exe
1724	omsecor.exe
1284	omsecor.exe
1284	omsecor.exe

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exeomsecor.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 2120 set thread context of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 1708 set thread context of 1724	1708	omsecor.exe	omsecor.exe
PID 2892 set thread context of 1284	2892	omsecor.exe	omsecor.exe
PID 1756 set thread context of 1952	1756	omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

omsecor.exeomsecor.exe188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exeomsecor.exeomsecor.exeomsecor.exeomsecor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exeomsecor.exeomsecor.exeomsecor.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2120 wrote to memory of 2504	2120	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
PID 2504 wrote to memory of 1708	2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	omsecor.exe
PID 2504 wrote to memory of 1708	2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	omsecor.exe
PID 2504 wrote to memory of 1708	2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	omsecor.exe
PID 2504 wrote to memory of 1708	2504	188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1708 wrote to memory of 1724	1708	omsecor.exe	omsecor.exe
PID 1724 wrote to memory of 2892	1724	omsecor.exe	omsecor.exe
PID 1724 wrote to memory of 2892	1724	omsecor.exe	omsecor.exe
PID 1724 wrote to memory of 2892	1724	omsecor.exe	omsecor.exe
PID 1724 wrote to memory of 2892	1724	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 2892 wrote to memory of 1284	2892	omsecor.exe	omsecor.exe
PID 1284 wrote to memory of 1756	1284	omsecor.exe	omsecor.exe
PID 1284 wrote to memory of 1756	1284	omsecor.exe	omsecor.exe
PID 1284 wrote to memory of 1756	1284	omsecor.exe	omsecor.exe
PID 1284 wrote to memory of 1756	1284	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe
PID 1756 wrote to memory of 1952	1756	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Local\Temp\188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
"C:\Users\Admin\AppData\Local\Temp\188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
  C:\Users\Admin\AppData\Local\Temp\188182275496aca4c18bd8f37cca8778f090f19e428728c23e230754c23e5c11.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
246e779c7d8710aae4ad6fffb5c25ef0

SHA1
cc2f01a0d283a81fae3104a82e61893d27920758

SHA256
2d8754dd47261d05a711162503a199d4ebdce37de10f7bbba5b7b61e57d48619

SHA512
2e236fc497785d0dbb9feab658843cccf7465ecfef0651942d8ef7a4231b8fb517691e2ea60466dc1fdc2e2b69c4dd69cfeb7d9d3a6c59ef006a3b4a616029df

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
d05a9aa251bd60c98d788744342861e4

SHA1
65d294ce19443bb9982a378cac385decad479d55

SHA256
d23614c88ebacc943ad61472d2d604b78554d404b5ec9c9455d1c7deb0b74bde

SHA512
87176adcd08ce5b9e8afa79dc1a1f818ce688d75bebb50c7837a669a9089733d15e32dad21c316109d4f79f6ce4eecc7b260bb4e476fddf3ef62d22773d8258f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
fc7cb0ced6e503ff4570f7de8ff8db06

SHA1
9341831138f643c552192b1a9b68b6b14a7cee10

SHA256
9046014d951868b377d1b4d46ee13c25c3311fd708694707bbf601b52b17b60a

SHA512
de2d4d484f97d4dd7e85ac7a7c9d597bf73e8ed1e1d18da4770a9ed6552899986705afeee0a8df805de8052a1666ad114e165ad38a9fa32cd24e0dbe9779eae8

Download Submit
memory/1284-68-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1708-29-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1708-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1724-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1724-46-0x0000000000290000-0x00000000002B4000-memory.dmp

Filesize
144KB

Download
memory/1756-82-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1952-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2120-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2120-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2504-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-13-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2504-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads