neconyd | 431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1

General

Target

431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe
Size

248KB
MD5

23dc0fd56bdb2e4cc6d4cceb9ddc8b77
SHA1

ee2fb718a051145e2f3a788298611e97f7f13e0d
SHA256

431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1
SHA512

d5c8e2838993093abc4d4b7f43c6059118cddcf560613d238d9cdb140dff4ef306cb89c0b1797e2a218a7db96100c13eb2733ec41ecbb83346e3517ad154bd3f
SSDEEP

1536:24d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:2IdseIO+EZEyFjEOFqTiQmGnOHjzU

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid	Process
2032	omsecor.exe
544	omsecor.exe
4292	omsecor.exe

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/2032-5-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000d000000023b0a-4.dat	upx
behavioral2/memory/4088-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/2032-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x0002000000021ea9-10.dat	upx
behavioral2/memory/544-11-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/2032-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000d000000023b0a-16.dat	upx
behavioral2/memory/4292-18-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/544-19-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4292-20-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

omsecor.exeomsecor.exe431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exeomsecor.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exeomsecor.exeomsecor.exe

description	pid	Process	procid_target
PID 4088 wrote to memory of 2032	4088	431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe	85
PID 4088 wrote to memory of 2032	4088	431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe	85
PID 4088 wrote to memory of 2032	4088	431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe	85
PID 2032 wrote to memory of 544	2032	omsecor.exe	102
PID 2032 wrote to memory of 544	2032	omsecor.exe	102
PID 2032 wrote to memory of 544	2032	omsecor.exe	102
PID 544 wrote to memory of 4292	544	omsecor.exe	103
PID 544 wrote to memory of 4292	544	omsecor.exe	103
PID 544 wrote to memory of 4292	544	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe
"C:\Users\Admin\AppData\Local\Temp\431f90277dd316dd665622f30ed4310fef03369f0055034224697f820929ceb1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
248KB

MD5
2dec9ab61d5bed5588206c0d81a34552

SHA1
748f925eb78509a05affc0eb7becbe3dae172d31

SHA256
373a7f58087b1995a680e3711a47affd1c114b5eb46c1123066220e268ebcf6e

SHA512
c95e5208840b5d646a2a787307739d0c1563f56c73df76522f6550c7b307bf3a5b9f37b784d51f6391fbd0905a1d871fdae7d1f4a6b63b4da566da282caba669

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
248KB

MD5
e5308768fcfa4d524b47915244dcfe44

SHA1
487079db842d91730031db0f07462099fc737c87

SHA256
48dd5ace69077abf24fa2fa8e76721a388f69908d28746d3258ac4f0bcf3d1d1

SHA512
96f0668ee1e6b5e8c0422753135c8d66ce6d94fa1b7210c31e88bdd1615a71740965eb207bf07fe9c760e85880b7f3f311debf08ff4e9dbb7e6ca8a2d247e356

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
248KB

MD5
0f583236ea21d0acf5be9f5b58f9fd8d

SHA1
73895f3548e2d6f38d7379cf83ddbf506445c8f2

SHA256
77b3b3bdccd683101dfb5bf2e75c6889c924c46d0570ede544a59d091c51833b

SHA512
a005e4f601f7dfddffe35d0e9fa353e141964fc0c590b4c79e93dc13ac41aa66e626272ff578779586d65adbf0af2565e9b5bd663ed24219c7c72c14772b55c1

Download Submit
memory/544-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/544-19-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2032-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2032-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2032-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4088-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4088-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads