General

  • Target

    29c39eae56c0ef050b02908bfb0545b5aaa3c4876e96cde988c483037f1a0572N.exe

  • Size

    96KB

  • Sample

    241129-th8btsyngp

  • MD5

    97e02755301e3dbeb369f6b81bea8240

  • SHA1

    4f12c4ec9b299492d1ceec7685f40ad7c79f675a

  • SHA256

    29c39eae56c0ef050b02908bfb0545b5aaa3c4876e96cde988c483037f1a0572

  • SHA512

    7af6fb1da232392a862aec727768842ddf62a2814f8ada1f084243701924c44d6b83833062ae149e8b7d63f98341d6b7672e64df8ed2c1f2061071b37297c5a6

  • SSDEEP

    1536:EnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:EGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      29c39eae56c0ef050b02908bfb0545b5aaa3c4876e96cde988c483037f1a0572N.exe

    • Size

      96KB

    • MD5

      97e02755301e3dbeb369f6b81bea8240

    • SHA1

      4f12c4ec9b299492d1ceec7685f40ad7c79f675a

    • SHA256

      29c39eae56c0ef050b02908bfb0545b5aaa3c4876e96cde988c483037f1a0572

    • SHA512

      7af6fb1da232392a862aec727768842ddf62a2814f8ada1f084243701924c44d6b83833062ae149e8b7d63f98341d6b7672e64df8ed2c1f2061071b37297c5a6

    • SSDEEP

      1536:EnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:EGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks