neconyd | 08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b

General

Target

08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe
Size

80KB
MD5

bb7172d759a55044a6a5b48b3ddab5b6
SHA1

dfae366a0746891116f89d849fd7764b4fa04abe
SHA256

08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b
SHA512

aa713b60144290da3f03abf22b44e3259c14358f8184159e22bd295dc00a072ec02d6d2f3e09c67360c05f7c83fc44ef99435187eb90c9dd0e9a16a46cd2cfbc
SSDEEP

768:6fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAO:6fbIvYvZEyFKF6N4yS+AQmZTl/5m

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1932	omsecor.exe
2420	omsecor.exe
1388	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe
2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe
1932	omsecor.exe
1932	omsecor.exe
2420	omsecor.exe
2420	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1932	2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe	30
PID 2536 wrote to memory of 1932	2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe	30
PID 2536 wrote to memory of 1932	2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe	30
PID 2536 wrote to memory of 1932	2536	08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe	30
PID 1932 wrote to memory of 2420	1932	omsecor.exe	33
PID 1932 wrote to memory of 2420	1932	omsecor.exe	33
PID 1932 wrote to memory of 2420	1932	omsecor.exe	33
PID 1932 wrote to memory of 2420	1932	omsecor.exe	33
PID 2420 wrote to memory of 1388	2420	omsecor.exe	34
PID 2420 wrote to memory of 1388	2420	omsecor.exe	34
PID 2420 wrote to memory of 1388	2420	omsecor.exe	34
PID 2420 wrote to memory of 1388	2420	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe
"C:\Users\Admin\AppData\Local\Temp\08d828aeb27484f2d29c2dacf522e75c43ceda3afdd64a0c79e76a28bb32724b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
97710b8c475e29d7031f8157bc61f081

SHA1
8a701d441f39b9c65780b7e0c0b6b942d818c12b

SHA256
c8396e75e40a627b539deb040490d22c82f7d620f0022966c743f36a9a423f14

SHA512
66d84558868139801672c20ba23f1f1bc5a02c021ac0697686a40aeb0f0ebbc1041155cdac361d1a96ea11638ced492978bea9a552f322a5eb0d3e16d08de1cb

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
a91c0a3f46f02fbb086e70863d4e5e2d

SHA1
9d36857bdb707f126fcb78aacc15d5ae71a82d4c

SHA256
968ced0e3e046a664cb61c634dab1ea8220107296ddc038e2c26578dcb36ba99

SHA512
6baba55293ab09c76359d19f374403ca9c1ff3fbec5bbc40233e257ad59bf43d9501c5ae4e2051319b3b5dabea8b8881fb957757d7dfe0f7082fe2898560d37e

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
2dc811e1bdbf742614309595eb051260

SHA1
4c2115230fe6b9b3976772a271514198a7021c9d

SHA256
ba3941ddba56682ec73489aa7fdb4ac78089d72ec5760d95dde06a4697d44532

SHA512
320cc8988dee140d0c51be881c9ae1740c1b3bba11b8cb67a62f8b9e74bff91a0751ff9dd59f609e9da04b3d97a0e66ad9e7a0255593b346683546ce10d0a6ad

Download Submit

Analysis

Sharing