neconyd | e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333

General

Target

e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe
Size

71KB
MD5

b0c8c1254d019f91b0de53fd83e2e3f0
SHA1

2691422a374d6f503a5f19577963c40f7b266ebb
SHA256

e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333
SHA512

088962a81cfa4584eeeb71fb7b8c16b6ac76f65bc0cfa9f625d0ad2698bf63e279375c78ed5b4a179e10b5b85b88b228547f9abda8e66d36adfff56c507e7372
SSDEEP

1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:rdseIOMEZEyFjEOFqTiQmQDHIbH

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2616	omsecor.exe
1756	omsecor.exe
2980	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe
1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe
2616	omsecor.exe
2616	omsecor.exe
1756	omsecor.exe
1756	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2616	1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe	30
PID 1524 wrote to memory of 2616	1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe	30
PID 1524 wrote to memory of 2616	1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe	30
PID 1524 wrote to memory of 2616	1524	e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe	30
PID 2616 wrote to memory of 1756	2616	omsecor.exe	33
PID 2616 wrote to memory of 1756	2616	omsecor.exe	33
PID 2616 wrote to memory of 1756	2616	omsecor.exe	33
PID 2616 wrote to memory of 1756	2616	omsecor.exe	33
PID 1756 wrote to memory of 2980	1756	omsecor.exe	34
PID 1756 wrote to memory of 2980	1756	omsecor.exe	34
PID 1756 wrote to memory of 2980	1756	omsecor.exe	34
PID 1756 wrote to memory of 2980	1756	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe
"C:\Users\Admin\AppData\Local\Temp\e1caa22d8e22e0fb18a02f3f9910643ef9d84a40b93f6b456c243217ff532333N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
c25bc798874c6e73e9f61cf5d6168dfb

SHA1
fa603b8041c897c19b1367991a163d8bff6d8e31

SHA256
1300ff371f34d366efce72c322c9381317ce39168dce31417df89be08be46e9b

SHA512
1eba10ceec01c3271ee3b65a3454335c5e9627e4d473b4157b6428f50b95d127c5ad14023d60b06b646d046336f473cd585e8c605491982eebb25812d5bd0caa

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
52f56d8aa1d18cc309eb0e43b49e61b0

SHA1
a8be49d99fc6c3d9f816ca1a6ba8abbc6fc859e8

SHA256
4952155e8dfc238d7818488d0ee453f0bfb788450b0eca4bc36db53eb75837a8

SHA512
39d87d85ca6509b19d6ee365ba4449bb85d1c1b46bf8d70c35514635d18f630516f3c38a377529ac23cb5f6c2b22613ac602582e4eb4d572ee53375e98d9680c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
9b01cbd841680e1ac5bef74eddedb34e

SHA1
fdb2c70013be09f4b4a28462c810d716dd79a68e

SHA256
8c9420f3c67e583889a1afc94d2fdc08b96e8cb8a4314c496693daf71b398796

SHA512
491be71e055791e57f1f1c1134a121eb97dadd44a67f2754a63dddfe9193b995a3c51af96603fdf9223779308ec01906922bab5069d5e020d602b567e253820f

Download Submit
memory/1524-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1524-4-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1524-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1524-10-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1756-34-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-18-0x0000000000280000-0x00000000002AB000-memory.dmp

Filesize
172KB

Download
memory/2616-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-38-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing