neconyd | 979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13

General

Target

979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe
Size

62KB
MD5

9ad6250a85082edeec3963bf3880ac2f
SHA1

944b1d62a57318d6b7d5acb20843984813b061cd
SHA256

979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13
SHA512

2e6f749acada8c660dfc3af2376cc84766269cb32d671d54594b2c8e30deae14f89ffb4076a4b4360b9195a98138a6e2e0e444300ee98e1e349919c0e097539d
SSDEEP

768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA1:NbIvYvZEyFKF6N4yS+AQmZtl/59

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1072	omsecor.exe
2284	omsecor.exe
2040	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe
1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe
1072	omsecor.exe
1072	omsecor.exe
2284	omsecor.exe
2284	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1072	1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe	30
PID 1824 wrote to memory of 1072	1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe	30
PID 1824 wrote to memory of 1072	1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe	30
PID 1824 wrote to memory of 1072	1824	979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe	30
PID 1072 wrote to memory of 2284	1072	omsecor.exe	33
PID 1072 wrote to memory of 2284	1072	omsecor.exe	33
PID 1072 wrote to memory of 2284	1072	omsecor.exe	33
PID 1072 wrote to memory of 2284	1072	omsecor.exe	33
PID 2284 wrote to memory of 2040	2284	omsecor.exe	34
PID 2284 wrote to memory of 2040	2284	omsecor.exe	34
PID 2284 wrote to memory of 2040	2284	omsecor.exe	34
PID 2284 wrote to memory of 2040	2284	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe
"C:\Users\Admin\AppData\Local\Temp\979004c4485f5fa39b8fd97543b66034f2ca924736feaf832456543430fb8c13.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
fb56fc034b5bd064eec376de179f768d

SHA1
e50b09242b2fee7ce2b9ea5770c5af0f47d94b0e

SHA256
f0cda539013b404dad78946f82eb6d11dcbb74508bd61ca7800c61c614b4ecf5

SHA512
72af281670175471cf29a08744bb7da0c81b29d82b9eee6d27a4a8d69787b10cac9c404d76a095c5b361763d4d2ad3241438cdfc8d0708fef32afb9030712bd3

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
8edebe5f32751f5e4380083b89a0bdcf

SHA1
7f23741317d3bfca27c6654e27fdb764353aa04a

SHA256
c3ca30235cd4b501fd3df772c3355277bb6732dfe466593743c5baadd162867f

SHA512
020dffd8b68377322a393ba3840e3530b932a407df081472a6848ce6cde007802ebf98957bd6787a641b25254c7f8de38f19b36f42b32f0d6f97f7509c8e11da

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
62KB

MD5
b683a089d2cde777dbffdb24a4107e18

SHA1
1413e2d2f95095e992dee96c5ffea41a54cf43c3

SHA256
28a60ed77b3070d81356d583a50eb7b26587ae95d344de42218809e1b434bce0

SHA512
0a1006bf4ce5f1c8fe9dca83fc6d6449c432a9702371e9edea0166cfef09725479e96ff6cde81f3c4c8217bc20ba0eb1e6791fe607c33725143880ba9a0a939e

Download Submit

Analysis

Sharing