neconyd | 32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad

General

Target

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Size

61KB
MD5

13ebb36e596146a672c3ff8b6e08c2d4
SHA1

b2309079bdbd23463c4f60f962494b2888e5452c
SHA256

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad
SHA512

c9cf11d45bbd98d883069c9dcf681cc3bfe34d791809f59c1ab6a6fee6cbffe1648c3d6aebdfc028d0398990e7a4719682c0edf7c8890448c27160d2f8557c18
SSDEEP

1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZxl/5:QdseIOMEZEyFjEOFqTiQmTl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1816	omsecor.exe
2292	omsecor.exe
844	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
1816	omsecor.exe
1816	omsecor.exe
2292	omsecor.exe
2292	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1816	1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 1144 wrote to memory of 1816	1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 1144 wrote to memory of 1816	1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 1144 wrote to memory of 1816	1144	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	30
PID 1816 wrote to memory of 2292	1816	omsecor.exe	33
PID 1816 wrote to memory of 2292	1816	omsecor.exe	33
PID 1816 wrote to memory of 2292	1816	omsecor.exe	33
PID 1816 wrote to memory of 2292	1816	omsecor.exe	33
PID 2292 wrote to memory of 844	2292	omsecor.exe	34
PID 2292 wrote to memory of 844	2292	omsecor.exe	34
PID 2292 wrote to memory of 844	2292	omsecor.exe	34
PID 2292 wrote to memory of 844	2292	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
"C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
1e8eef8662afbdc724d0566f3912e83c

SHA1
bf7d5bc6a5d60cafd771afb6e8cfad7630774945

SHA256
322f3b6b964a07bbe67dce324b3dfa23b8d85e84e208ffcd38b0b8946ce5e520

SHA512
6a1d3d2415997b266c12a90e3ef133f21e3d05affa4159dd407b8cfa8030b576ca612a51a05f2e27d097783b9aa3b83a6495d74c0234c8cf16d47a1d8a6522fc

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
8896482d9308d5850788f356804bc459

SHA1
3f9a3dcfc45c7ecf82df56dde1a0bb19b61f4c8d

SHA256
93d97c434c38b7932b21380a333951e95c29469c582b1302eadb631314720a18

SHA512
8c67bd3bd71d138c15e68dbad02c5dbaaa4d4e3a2047274ae40ab2a874fef8ec2afa09fd76b50b198b5781e9bbef3e1a37cbdadffaf46153c1b8601f7dfbbe3d

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
827bd5d54b0bdeb879eaf031892c0412

SHA1
3726fe51e3ce2ec15ca7a6cc55b765ab0231be57

SHA256
5dbff40499d51104b12cef490ad8dfc5f98b02759aa5815cd0a5142220f10255

SHA512
9591ab757acfbc056f12e019bf31da96da99f3d8b9404a0d40b3880eabac4ed2faca0132c2fea00381609fc81a0e621be34ecb1d1b14c6f8d9829440e58ff4a0

Download Submit

Analysis

Sharing