neconyd | 65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216

General

Target

65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe
Size

84KB
MD5

473ddfb6ae7d98674ee92e1ec0f80a80
SHA1

a4e147fcb2f55603a63add10674d9d41175df357
SHA256

65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216
SHA512

588cef481c93983b3954dd53858582a353b10827185a0aa74149d30a9683cdf7d8b654b29f45576b075f601dee1752be3601956ffc509af99c9509a80997c394
SSDEEP

768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1688	omsecor.exe
2588	omsecor.exe
2840	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe
2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe
1688	omsecor.exe
1688	omsecor.exe
2588	omsecor.exe
2588	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1688	2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe	28
PID 2052 wrote to memory of 1688	2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe	28
PID 2052 wrote to memory of 1688	2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe	28
PID 2052 wrote to memory of 1688	2052	65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe	28
PID 1688 wrote to memory of 2588	1688	omsecor.exe	32
PID 1688 wrote to memory of 2588	1688	omsecor.exe	32
PID 1688 wrote to memory of 2588	1688	omsecor.exe	32
PID 1688 wrote to memory of 2588	1688	omsecor.exe	32
PID 2588 wrote to memory of 2840	2588	omsecor.exe	33
PID 2588 wrote to memory of 2840	2588	omsecor.exe	33
PID 2588 wrote to memory of 2840	2588	omsecor.exe	33
PID 2588 wrote to memory of 2840	2588	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe
"C:\Users\Admin\AppData\Local\Temp\65851c803f16a487e1748343eba610447f396a99c1ebd5cff794af25613b0216N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
3901cbdf3123e5d8c71ef81ac8ac29f9

SHA1
67065163ae5a891d30630f25e474788273ee3ae1

SHA256
0d22450fe180793ad50363b7d19ceae567c12efbdb78990d5b258e18c82eb1a6

SHA512
a3695137a51354f7cc5dbe4bc4f1a462c2efb728e37d72d21e80ae47517f6210b1038eb55327a18808a56ed22bb2e125a63657cfa9046cf4c292af7805708b68

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
96c6d63d077d108120f6880e289ff03c

SHA1
2b2fa700211b533e249f76930237a54988e5194c

SHA256
2c8386833a49ad28f1d533c4a4145e712444e725297ca0b2022b5d2cbed74436

SHA512
cd290ffa54715e37e5c744b7b429d902049c2a6ce6453d4dd770442e8b9e8410c5470394de58c235ce94c5f095812b7e7351bc992c3787429d9530dbf9d0b300

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
84KB

MD5
c7c23372c7647017cf7cab0c19887d4c

SHA1
7c7878ab337f2b1a2d0d24dee92cb897dd6c882e

SHA256
3dac664e98f4f6a9ba00ccfbd4a41ed30b0b543b24aa3300a5a933af1a184b3c

SHA512
dd2e4b2186cfcc384ced89f93a50c8c0c0203b9186a2a992f3f9e1ab14068013a76274cb5f526603d65652d42a7a53b0f6b291530cfc47b1f26481e3fdf4f461

Download Submit

Analysis

Sharing