neconyd | 0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3

General

Target

0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
Size

64KB
MD5

c44f8b816073ca9d49f324ec821409a5
SHA1

b9c1b7c3558f2614ddc93a797dedf05c4ff02a83
SHA256

0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3
SHA512

3ea7a4174499d147ded7218caa02c7e07a898bd56729ff19d758ba5b63129e2178d4bd0ac0b0ac9b947bbbac87a8c9a839ba5b3e5e7299ffdc9a9519bd0ff83b
SSDEEP

768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uAv:bbIvYvZEyFKF6N4yS+AQmZcl/5H

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1944	omsecor.exe
2608	omsecor.exe
2816	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
1944	omsecor.exe
1944	omsecor.exe
2608	omsecor.exe
2608	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1944	1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	30
PID 1836 wrote to memory of 1944	1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	30
PID 1836 wrote to memory of 1944	1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	30
PID 1836 wrote to memory of 1944	1836	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	30
PID 1944 wrote to memory of 2608	1944	omsecor.exe	33
PID 1944 wrote to memory of 2608	1944	omsecor.exe	33
PID 1944 wrote to memory of 2608	1944	omsecor.exe	33
PID 1944 wrote to memory of 2608	1944	omsecor.exe	33
PID 2608 wrote to memory of 2816	2608	omsecor.exe	34
PID 2608 wrote to memory of 2816	2608	omsecor.exe	34
PID 2608 wrote to memory of 2816	2608	omsecor.exe	34
PID 2608 wrote to memory of 2816	2608	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
"C:\Users\Admin\AppData\Local\Temp\0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
9eb8c5e012218152a1dbca9fe39e2463

SHA1
2810f85a53291aabb51f533e375c60a885806917

SHA256
f7758f80e8d2b5b2d6d7ddc3bc44026e86dfcf837fc3db6a4ccbf977039a329b

SHA512
029439e1190c65c570d4e942eff5b2198a3d22e2496c78bec25cc88938e138e81dabda3936e098c99e09d8e1ae23a97a61c6ef996c1fc69c448fe033423db721

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
8e05994d43b0eb4c142215e44bcb4254

SHA1
a1c1faf0369d21bf941a7aeebdbaac1ff82e8575

SHA256
fdf3883fbb92b386cb60ddc820c91a744ce05168740e465d0fb0619c3b3bc8d6

SHA512
26037d46fdf562958a11f1f04b1cc8d0a963a9168ecaf5e12f1ecd7744ca5f8870a5109a5658f0e9ea3b069f6deed788ec70ce5b756d1e0224244be0e4cb575c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
328426bb7c670221851627f16e25302d

SHA1
d3affe1a89c100d5d17f4c3b0c901ddcf9584318

SHA256
3efe7ab81e81c307fa7c0d027dc377e63a0a9dd11f6cb5327d0e36e76237d59a

SHA512
416e0bc1a3c7fb7d3b31172a771ce4a949cb5ab93722886dab866f43e88ca20b48813c00774b9bec6255604ae8103a53b761eacb501b3f2f731281998b72eafe

Download Submit

Analysis

Sharing