General

  • Target

    202257007295d6074ebcd93c9dd7ea1eda9402770f58f547c390555e707d3debN.exe

  • Size

    134KB

  • Sample

    241203-twmbhssrgs

  • MD5

    622a24ded3eadc25a3f5f6fac27c8e60

  • SHA1

    1d7fe49b2aae07c9cd77860f13b0eb753d3611e1

  • SHA256

    202257007295d6074ebcd93c9dd7ea1eda9402770f58f547c390555e707d3deb

  • SHA512

    3a7919f01563396d1aab3fc2c2d05c4fa32c754c312daff21c5364e70a17d9264282b17a7bf2e494b864c94f6600eb6b876d5a5d7f19e0e0d2a0dbeffc7e46e8

  • SSDEEP

    1536:sDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:SiRTeH0iqAW6J6f1tqF6dngNmaZCiaG

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      202257007295d6074ebcd93c9dd7ea1eda9402770f58f547c390555e707d3debN.exe

    • Size

      134KB

    • MD5

      622a24ded3eadc25a3f5f6fac27c8e60

    • SHA1

      1d7fe49b2aae07c9cd77860f13b0eb753d3611e1

    • SHA256

      202257007295d6074ebcd93c9dd7ea1eda9402770f58f547c390555e707d3deb

    • SHA512

      3a7919f01563396d1aab3fc2c2d05c4fa32c754c312daff21c5364e70a17d9264282b17a7bf2e494b864c94f6600eb6b876d5a5d7f19e0e0d2a0dbeffc7e46e8

    • SSDEEP

      1536:sDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:SiRTeH0iqAW6J6f1tqF6dngNmaZCiaG

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks