neconyd | ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737

General

Target

ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
Size

90KB
MD5

7febbbf1966e907f2d6a1bf15eae6bde
SHA1

94b861a98d91c5190cfa6c2b2ae03f707fe075a3
SHA256

ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737
SHA512

da866cf120eda097044694800ec09faec6fc248abb3a97dc11d665a6ac3ef75eb3445b8d7928d6dfd79f46923e4c38f2da9288377007210223c27081b71e59ae
SSDEEP

768:NMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uAe:NbIvYvZEyFKF6N4aS5AQmZTl/52

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2080	omsecor.exe
1700	omsecor.exe
1304	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
2080	omsecor.exe
2080	omsecor.exe
1700	omsecor.exe
1700	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2080	1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	30
PID 1792 wrote to memory of 2080	1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	30
PID 1792 wrote to memory of 2080	1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	30
PID 1792 wrote to memory of 2080	1792	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	30
PID 2080 wrote to memory of 1700	2080	omsecor.exe	33
PID 2080 wrote to memory of 1700	2080	omsecor.exe	33
PID 2080 wrote to memory of 1700	2080	omsecor.exe	33
PID 2080 wrote to memory of 1700	2080	omsecor.exe	33
PID 1700 wrote to memory of 1304	1700	omsecor.exe	34
PID 1700 wrote to memory of 1304	1700	omsecor.exe	34
PID 1700 wrote to memory of 1304	1700	omsecor.exe	34
PID 1700 wrote to memory of 1304	1700	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
"C:\Users\Admin\AppData\Local\Temp\ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
1d1cc92b1f0251c2c8476fe0f54df325

SHA1
a10dd01c60c05097d464f3db92549a8c1e7936ff

SHA256
63b9c400bd44b31c38a19cdc4e053b20a7e7c3b4b191168f2e37b581c004a927

SHA512
f39746c5441fa46276a70ac454e5bd25724819feec8b9b1112c0e41e3124c8463d64a52c1b2f69305d07990f6ede4293961c2fa22f00b49312280691aa5694b0

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
38d3dab42dbfbc0324740b9e0789eaef

SHA1
f8111a24f8e35dcb999b1deab0134e6b5ef67da1

SHA256
28571377535536a7666dd9b792b39ccc3f6d139054e94acbce7e3aea0b6423e8

SHA512
852d52db6b494cf8a25f6d0e968d5aa4df2db191d90a7d1add462a7a8b92fedb7a73f789f9f07083fd3d415517566d4fb08222cebf02baf19395ac4951a71e98

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
745e70ecef5aeea2a6a6a01b7f85df0b

SHA1
01f4dcfbffc03d8e9ff746effff7a5ea2175af04

SHA256
18a5c334ee7a51289ff3bdab3b4c704695072fd8d8856713f881ff5e53858776

SHA512
60e2fb304f435b2043b9fcb0e5db7b38bd072ec01d17f968d7931244715cd8c9df465de879846046a28e204507cbf2a33c0e249182148061fe57c97893c539f1

Download Submit
memory/1304-37-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1304-39-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1700-33-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1700-34-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1700-35-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1792-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1792-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2080-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2080-23-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2080-17-0x0000000000290000-0x00000000002BB000-memory.dmp

Filesize
172KB

Download
memory/2080-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing