neconyd | 274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2

General

Target

274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe
Size

62KB
MD5

def4277f492dc31aaeb57d68056cce01
SHA1

6d8e3f11b79f0ba3f6417498f29350cef5981d1a
SHA256

274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2
SHA512

536988634a5da74869db2a1fb22d3a03b1b423c732f70cfa9cdcb1ea4a89bdfd99bd54b8f08fe4689d129a97cd29f55dcb4bc939162a637b673aa3839624b3e7
SSDEEP

768:yMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:ybIvYvZEyFKF6N4yS+AQmZtl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1172	omsecor.exe
1992	omsecor.exe
1988	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe
1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe
1172	omsecor.exe
1172	omsecor.exe
1992	omsecor.exe
1992	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1172	1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe	30
PID 1176 wrote to memory of 1172	1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe	30
PID 1176 wrote to memory of 1172	1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe	30
PID 1176 wrote to memory of 1172	1176	274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe	30
PID 1172 wrote to memory of 1992	1172	omsecor.exe	33
PID 1172 wrote to memory of 1992	1172	omsecor.exe	33
PID 1172 wrote to memory of 1992	1172	omsecor.exe	33
PID 1172 wrote to memory of 1992	1172	omsecor.exe	33
PID 1992 wrote to memory of 1988	1992	omsecor.exe	34
PID 1992 wrote to memory of 1988	1992	omsecor.exe	34
PID 1992 wrote to memory of 1988	1992	omsecor.exe	34
PID 1992 wrote to memory of 1988	1992	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe
"C:\Users\Admin\AppData\Local\Temp\274ad00fdc29f464258332aad183ebe3bcb89f81a29c88db10d9e72241d27cc2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
13143ea92957da205ee579e047eb2800

SHA1
a78cc430f7f540d379e3b4c521f1aabf56ec87f2

SHA256
d6956cd8be80a5683330c56562b7bd0186749de2024705ef675c71ff707b2de3

SHA512
2d4e6b7c07cc5003c395a454eb4522a987906887de3fa2f1e2a581a8deb683e7948663fda32bb4880b0b76cdfbaa511a468eafe0e62d89ca131a0f15d8ab2603

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
d112f82bfac21c6bd1f4acbe3e04ec37

SHA1
dad2cd6d74a4590e6dacd355ec1421f524e67fd6

SHA256
b17f4bc5abc5de8da044d87978bcbb78517179ad0aaca836545d371bcf66e6a3

SHA512
2dbae39bc5b93fae64656e752c5f1e58254f783c41157d0aecf960f7dc1186e3038fe7cb0daf4f47eddd6acb5919221ce5907f0fab9e3ff73f850c7cf7307c98

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
62KB

MD5
f7e0308f453fa96fdf1a327694563d5d

SHA1
67f1edec775471f3b1ba0b3dd85fd913bc77569c

SHA256
15388cd5e97334b047afc0b997d11e4e9f47278d970285bbcd1f2919adcd375c

SHA512
6916f258e446068717cb544c01e11bd5558aaa249f5d3747aee64e3897c021c5db7a7ad436d326b126313263f8549493f2f6891e5b9805595f11f3ce86093fc9

Download Submit

Analysis

Sharing