neconyd | 3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5

General

Target

3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe
Size

62KB
MD5

eaa1226ce080f627ae1b7970cc599080
SHA1

4e0888d098670f9401b809e4954252c322a0f6d0
SHA256

3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5
SHA512

efb215ad87f7886149ce81c944c42fdcb7faa1603821cb5f87416e769ae100feaacb083e69ca96a0791af9903b3ad142f48ae418a754e2af7c4388ea79959362
SSDEEP

768:oMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:obIvYvZEyFKF6N4yS+AQmZtl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1248	omsecor.exe
2104	omsecor.exe
2880	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe
2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe
1248	omsecor.exe
1248	omsecor.exe
2104	omsecor.exe
2104	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1248	2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe	31
PID 2324 wrote to memory of 1248	2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe	31
PID 2324 wrote to memory of 1248	2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe	31
PID 2324 wrote to memory of 1248	2324	3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe	31
PID 1248 wrote to memory of 2104	1248	omsecor.exe	33
PID 1248 wrote to memory of 2104	1248	omsecor.exe	33
PID 1248 wrote to memory of 2104	1248	omsecor.exe	33
PID 1248 wrote to memory of 2104	1248	omsecor.exe	33
PID 2104 wrote to memory of 2880	2104	omsecor.exe	34
PID 2104 wrote to memory of 2880	2104	omsecor.exe	34
PID 2104 wrote to memory of 2880	2104	omsecor.exe	34
PID 2104 wrote to memory of 2880	2104	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe
"C:\Users\Admin\AppData\Local\Temp\3bc1faead5289ca45c3205eedfcd4933727c606e20d340f24d511e6e69c4fdd5N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
ae21ab55abb72c96b2a8a9f102416bf3

SHA1
ec7b84a113a49bfb9aa172b5d442fe13a323c579

SHA256
7256a2e4fcc9d8cd9873dc8e4d19778760a80f6a57aeb4cf3fcb342bea3ae235

SHA512
1c951291fa3f41f47ee0a097d1ed7cb588c5bdb04a4ec4b6421cff535ee2bd4e3ecc1607fcb0528588addc494ae6b18438e20aa1cf794bc0151406841709ccaa

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
51d1b78bb168ad7f422fd268a956d336

SHA1
cd19c31281550f51b3f0a759079dcf347f57a595

SHA256
490eb19c0834edcab0823564d9e3b5ffea1f693406d5a583c82081a8e9786e1b

SHA512
645e2b2449f1eedb1cf994deeef89aa534a430c6c7723f9f7b2ed1f8004fcea3de0a0176b1086de25cf06baf5e6f48ca8d73559f9d1486ab97ff54c3dc12cfc2

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
62KB

MD5
2ce96108c63423395c4fc92a9c6bd689

SHA1
cf3274775df3ab0b0287e59424b1332f262fe232

SHA256
acc71a80250af1bb681eb74f1acc498253ca2f3e25fb0c2447aeaaafa092acb5

SHA512
6d6277de97f3c8703a5ef085e54e8484b9029609c32d4d65de639899d49d04de14eb19fa49925f71a6722864379957511e88a65f7ac73f2c47c5c5026dbac73f

Download Submit

Analysis

Sharing