neconyd | 32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad

General

Target

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Size

61KB
MD5

13ebb36e596146a672c3ff8b6e08c2d4
SHA1

b2309079bdbd23463c4f60f962494b2888e5452c
SHA256

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad
SHA512

c9cf11d45bbd98d883069c9dcf681cc3bfe34d791809f59c1ab6a6fee6cbffe1648c3d6aebdfc028d0398990e7a4719682c0edf7c8890448c27160d2f8557c18
SSDEEP

1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZxl/5:QdseIOMEZEyFjEOFqTiQmTl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2396	omsecor.exe
1860	omsecor.exe
1800	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
2396	omsecor.exe
2396	omsecor.exe
1860	omsecor.exe
1860	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2396	2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 2388 wrote to memory of 2396	2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 2388 wrote to memory of 2396	2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 2388 wrote to memory of 2396	2388	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 2396 wrote to memory of 1860	2396	omsecor.exe	33
PID 2396 wrote to memory of 1860	2396	omsecor.exe	33
PID 2396 wrote to memory of 1860	2396	omsecor.exe	33
PID 2396 wrote to memory of 1860	2396	omsecor.exe	33
PID 1860 wrote to memory of 1800	1860	omsecor.exe	34
PID 1860 wrote to memory of 1800	1860	omsecor.exe	34
PID 1860 wrote to memory of 1800	1860	omsecor.exe	34
PID 1860 wrote to memory of 1800	1860	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
"C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
1e8eef8662afbdc724d0566f3912e83c

SHA1
bf7d5bc6a5d60cafd771afb6e8cfad7630774945

SHA256
322f3b6b964a07bbe67dce324b3dfa23b8d85e84e208ffcd38b0b8946ce5e520

SHA512
6a1d3d2415997b266c12a90e3ef133f21e3d05affa4159dd407b8cfa8030b576ca612a51a05f2e27d097783b9aa3b83a6495d74c0234c8cf16d47a1d8a6522fc

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
0426203cbbba8cc8efb136895a3f61c7

SHA1
e5a0dcc83eb4e692fd55400ded42b1fa25b6700f

SHA256
851a8a8e8d1c505caee57411bc0dd761e834eaea3d541ad98dc6bf998c525846

SHA512
3ba404e3eff1adb1c6adb9f39d271f17b4a516f9ca7bfeed865dc2bdd1b2525e53654566bb9000423b5d7cc7ff3f22abe7ce33713652252a36823d60b870203c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
5c319409d97cd1185b5dc359df4aa19f

SHA1
f48faed4e3489aa2c3a8e5ce315a8e465bfe6779

SHA256
232f2948543bc55efb1bb57197b2d7d4a73e21e3ea4b992798c3ff4983c49762

SHA512
946839b132c5d48e0438e9126dd0701627f868a2cd40bb117403920a6191bdd5c86e0a3251b39f8887d13f4462bafc95f6288f6ef0b4c4834d8413a5e1285bb3

Download Submit

Analysis

Sharing