neconyd | ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009

General

Target

ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe
Size

64KB
MD5

9e0a955da113d1de1e82afdf2e8464df
SHA1

61b531f015149c0c82aafc96903ae3557e574e39
SHA256

ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009
SHA512

95d18bd2e1d650ec2d0eb13cd4ffd9bb291313599510663a1def54b06e1e7074a7a4ec090eb2ccf3e19e262219834bd74405e9be352c426cfbb1d92cfa34f5bf
SSDEEP

768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:IbIvYvZEyFKF6N4yS+AQmZcl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2520	omsecor.exe
1984	omsecor.exe
2036	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe
2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe
2520	omsecor.exe
2520	omsecor.exe
1984	omsecor.exe
1984	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2520	2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe	31
PID 2132 wrote to memory of 2520	2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe	31
PID 2132 wrote to memory of 2520	2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe	31
PID 2132 wrote to memory of 2520	2132	ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe	31
PID 2520 wrote to memory of 1984	2520	omsecor.exe	33
PID 2520 wrote to memory of 1984	2520	omsecor.exe	33
PID 2520 wrote to memory of 1984	2520	omsecor.exe	33
PID 2520 wrote to memory of 1984	2520	omsecor.exe	33
PID 1984 wrote to memory of 2036	1984	omsecor.exe	34
PID 1984 wrote to memory of 2036	1984	omsecor.exe	34
PID 1984 wrote to memory of 2036	1984	omsecor.exe	34
PID 1984 wrote to memory of 2036	1984	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe
"C:\Users\Admin\AppData\Local\Temp\ab4ebe10c455386b14f644379fe6f4e91f73f9c41d247a7dfaee96051f692009.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
372a21ff777ad51df76c09ca7fa95749

SHA1
f498ff3379e53ce373dd9f8183c7d4ada4529d26

SHA256
cec1175d0c4445e5beffc36b3ee63aa2da03aa799918c1d630e64fd1a9b689b3

SHA512
15c90e6b4f7455c9f88166c5fabd414d9c15969323284997eb93633e7f99e5784424929f05140f26dbe07bb0f01628a5614bcf152889f9770851d3e684968849

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
8dfaa1ac6afe0c3e362c84e0f784f838

SHA1
3330427699525a1c3c3cc28e0b6fd3595605fd2a

SHA256
42a9c55a3e355cc48eaff1993fb7ce430519f95a62c87d034579b275137c6297

SHA512
96222cc43a27ff20a0aac7a7bffd4eb73bd2740739d03b77ff3bbbcc415a082de9512fd58122a3c80384f08a213a126abb4ac55b74c1723d993338f446573f97

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
172bd30a46434e58c4e9ccca86702195

SHA1
f49589a1ef7cbf91faa7ac09df1b586174cf09a0

SHA256
e552b2026a60a072b6f5731c5f9d6863ef6a954db115f89004403e6b245c7b90

SHA512
6e7dac17151a12d5ed8d00d4d60860099ec683b17879e872c98295f9a9a9dbb818ad37d2571c309d26d26a37bf0221edd90cd6ea2fd54210f3c42965e65c1f27

Download Submit

Analysis

Sharing