General

  • Target

    18ff163678f8e2d56287ff44a44c54cd5f06e6aa6276ed534a09681fd2214d0eN.exe

  • Size

    96KB

  • Sample

    241129-w9ws8avpdk

  • MD5

    097d8bd0729b57c4ea0f55dcc49efd60

  • SHA1

    e9e045e19973d2938f79f144f6217f24083b3629

  • SHA256

    18ff163678f8e2d56287ff44a44c54cd5f06e6aa6276ed534a09681fd2214d0e

  • SHA512

    2d2a45aedacd47b11755500a1a1ef230063c98b32144a59f032901fa2336a802469bbf2b38a3c8262426515933eb98d97e6acfbb665ddde01b6edb364b45e6f5

  • SSDEEP

    1536:AnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:AGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      18ff163678f8e2d56287ff44a44c54cd5f06e6aa6276ed534a09681fd2214d0eN.exe

    • Size

      96KB

    • MD5

      097d8bd0729b57c4ea0f55dcc49efd60

    • SHA1

      e9e045e19973d2938f79f144f6217f24083b3629

    • SHA256

      18ff163678f8e2d56287ff44a44c54cd5f06e6aa6276ed534a09681fd2214d0e

    • SHA512

      2d2a45aedacd47b11755500a1a1ef230063c98b32144a59f032901fa2336a802469bbf2b38a3c8262426515933eb98d97e6acfbb665ddde01b6edb364b45e6f5

    • SSDEEP

      1536:AnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:AGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks