neconyd | 25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f

General

Target

25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
Size

71KB
MD5

e3e2b715ff511fbbd1319f4d9be1b785
SHA1

f1ca8fd66c392b948dea7821426f49b573d221ac
SHA256

25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f
SHA512

2e3ea75048665116096378c6c3b629e1a26d068f60ae6d60e86ad81b33ec5aa5c5e2958249d049e320e59c3b2b32f7949b3f83fe874d5f30fd079e2b16dda754
SSDEEP

1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbHP:idseIOMEZEyFjEOFqTiQmQDHIbHP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2396	omsecor.exe
2120	omsecor.exe
2696	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
2396	omsecor.exe
2396	omsecor.exe
2120	omsecor.exe
2120	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2396	2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe	30
PID 2224 wrote to memory of 2396	2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe	30
PID 2224 wrote to memory of 2396	2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe	30
PID 2224 wrote to memory of 2396	2224	25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe	30
PID 2396 wrote to memory of 2120	2396	omsecor.exe	33
PID 2396 wrote to memory of 2120	2396	omsecor.exe	33
PID 2396 wrote to memory of 2120	2396	omsecor.exe	33
PID 2396 wrote to memory of 2120	2396	omsecor.exe	33
PID 2120 wrote to memory of 2696	2120	omsecor.exe	34
PID 2120 wrote to memory of 2696	2120	omsecor.exe	34
PID 2120 wrote to memory of 2696	2120	omsecor.exe	34
PID 2120 wrote to memory of 2696	2120	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
"C:\Users\Admin\AppData\Local\Temp\25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
a4a546865c15275cd7650dc69e579dcc

SHA1
6ae6d3db60b3b832fa0ce809eddb1a1a0ed26591

SHA256
8a63ea7898973bc3cbf3e1d6af5a461fd16568d620fd64528c0a6e10e26c2643

SHA512
48b373235e7c5e6f6993554d37fa94bfdc8a96181e8b56ca980924be900a78d395810b27cb3b7ee94c3353701dd63d3b59fdfc8fa2618a5db1221c594171facf

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
a467dacffa236582bde270dae965bfad

SHA1
29cecccb1735a73fd10a032ee4efae7f0417cca0

SHA256
1f61dd05b786ff5f0f3459e1457a50e144dc37e7e451f141f9b88d864630ab47

SHA512
c7856b273e80cc15ccf59ac9524198867f72d48e412e9dd91aa36e386261d3fbaaceb7176164cc5d70800d32a0debc4e37b39c1b77093c7c38b3041fbccf2f87

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
59ee93999468bd0e1730d1794ec94a30

SHA1
10cc8f9891e8d05fe0bd9c6ce96b3c33fde429dc

SHA256
61f0ef30e0d6bd6ae1b1a7e8fba531a71096fce47405d809b178f6b253cf109a

SHA512
a8419d95e3b6f0c59a8e0791f024deb745d4ae0688d673e5e82669194b28fbc3533f9167719e266ba72eacd5d8384d6b215ae68431131aed9c136e95a90166a4

Download Submit
memory/2120-32-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2224-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2396-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2396-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2396-16-0x0000000001F30000-0x0000000001F5B000-memory.dmp

Filesize
172KB

Download
memory/2396-23-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2696-34-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2696-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing