neconyd | 77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5

General

Target

77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe
Size

61KB
MD5

9aa4fe48c6c10382a6e0a8bf173de4d4
SHA1

1a73200f7c814359918d3de71464c6c8c5e9fe6d
SHA256

77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5
SHA512

d449c7b5738a3f371d1d5633559f47443550efbdda0ab940d9d54f4828a8dfc5d9ba3df3a053a2a805540a9096355c1aedcdcb7e099538493fbee61472785ec1
SSDEEP

1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZWl/5l:0dseIOMEZEyFjEOFqTiQmUl/5l

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
536	omsecor.exe
2608	omsecor.exe
2924	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe
2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe
536	omsecor.exe
536	omsecor.exe
2608	omsecor.exe
2608	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 536	2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe	30
PID 2160 wrote to memory of 536	2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe	30
PID 2160 wrote to memory of 536	2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe	30
PID 2160 wrote to memory of 536	2160	77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe	30
PID 536 wrote to memory of 2608	536	omsecor.exe	33
PID 536 wrote to memory of 2608	536	omsecor.exe	33
PID 536 wrote to memory of 2608	536	omsecor.exe	33
PID 536 wrote to memory of 2608	536	omsecor.exe	33
PID 2608 wrote to memory of 2924	2608	omsecor.exe	34
PID 2608 wrote to memory of 2924	2608	omsecor.exe	34
PID 2608 wrote to memory of 2924	2608	omsecor.exe	34
PID 2608 wrote to memory of 2924	2608	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe
"C:\Users\Admin\AppData\Local\Temp\77c37dea54825b69e81b9d14ac1747613180e33c7ddda8b8c1f7db6a727898e5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
c4c775beefef8c30e8bee5b557e72097

SHA1
159ef294182d876934ae50dcd3a33968f4929a34

SHA256
bb1de747db573270cd77269292123214b8e6a15a3196ef5b6b64e37301fd1913

SHA512
bd5d9322ce82e03defa85c858c3aaed0c14217d07556e52e7b6571933ce93f04a749286623197e18ebad7bf370d5c950f796fcbc9ea296636e86d9564f6235cf

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
9cd614f027807783dade1ff6c9936a5c

SHA1
d55f7b3b87c4ee8b7c5e74b7a2dfa08f653e89ab

SHA256
636dd11c39ce0208ce42eb8d271f9e3af6b5590539fef6b4655032be2e30f6fe

SHA512
55224863f91bab378ff38187fc367c4874ecbd6cda8829b726f09c5f3b22eaa430cc20cede06dc2e1a5bc99dad4b859bf8566c3e559df71ca819cff43e32aa59

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
dd0fca55ad588841259848edd95b1138

SHA1
34ee8740274eb84bb1be816493d2c6695f8ba038

SHA256
7b7b2d8135ab4df3721ee46f800b7b7b990726a087432ff66f004ec975a7620c

SHA512
9bb3bf9b6f9fd66db4888ebf693d28f0bc62e3aba513e1ee633453f31e6c9ae3e88c56f264c49edd850cb47fdb63aa35ed803b18b8ef5b3689f46322eb07aff3

Download Submit

Analysis

Sharing