neconyd | e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf

General

Target

e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
Size

84KB
MD5

c394bcf1e6699c7f12c929964d80dbbd
SHA1

b2c7dd720e7d03e56bb5764e5c446cf6d97ed7ce
SHA256

e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf
SHA512

e5695803cce0aa43a15fc083cacf741253b980cfb54c5f89d16c547b72e414365336971f3ca16a8f523cf2e92f8e40f7e030ab98084b86f0b5fc5cb371402ef1
SSDEEP

768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAd:LbIvYvZEyFKF6N4yS+AQmZTl/5F

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2656	omsecor.exe
2124	omsecor.exe
2112	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
2656	omsecor.exe
2656	omsecor.exe
2124	omsecor.exe
2124	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2656	2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	30
PID 2088 wrote to memory of 2656	2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	30
PID 2088 wrote to memory of 2656	2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	30
PID 2088 wrote to memory of 2656	2088	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	30
PID 2656 wrote to memory of 2124	2656	omsecor.exe	32
PID 2656 wrote to memory of 2124	2656	omsecor.exe	32
PID 2656 wrote to memory of 2124	2656	omsecor.exe	32
PID 2656 wrote to memory of 2124	2656	omsecor.exe	32
PID 2124 wrote to memory of 2112	2124	omsecor.exe	33
PID 2124 wrote to memory of 2112	2124	omsecor.exe	33
PID 2124 wrote to memory of 2112	2124	omsecor.exe	33
PID 2124 wrote to memory of 2112	2124	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
"C:\Users\Admin\AppData\Local\Temp\e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
cd7e14257103e44b9c9584856e2daf9f

SHA1
a7e459f2fe03570359097073b194c5e555492256

SHA256
9634b47020e5ded8ed29819ab6428bc9e180780c03883f8d7a6bbd65fb72a149

SHA512
73e67568951d41e2347b5fba95b57db25e120ef027c299ec04f33be874ba4d49169e2a5678bdf8589b5b553357e7b5de5a915780c48590195f73e17a0a655e38

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
bb6c8593f76f85b798c6a0ed064abc4c

SHA1
5e5d423d3295fb7615ca0884fcbccb26f5ce844a

SHA256
b12a5b7476f2d737d91a0a6d41606b8e67718f3b351dc657bdce018322328695

SHA512
463227799aa827d2f7758992bef09898e20a926c59c8be04a7e7609db040eb00a9f9c7d9ee9b56b2d3499b3a05206c7b163fdbe5eaf1025b439fdc4e363caf73

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
84KB

MD5
9a1f4bce2ee4de7b8dfbdfee115e2a18

SHA1
36983c7c28b4323eced28d204550c3c179278c68

SHA256
df31e2fba9af512fe7541f547b8997d82a4d7ebab165c105aab9c4ef6eb6c63f

SHA512
9082cc07cbc9d574759f97fe9aa912251256f3ccb69554e7fdd6aeaa406fb88ddd460da37e7543c58e2278a2d12ea2e89491c856e33f5f18bac874e8bde7ff95

Download Submit

Analysis

Sharing