General

  • Target

    f9318a57a953b2026f76e7072af47d742ece3f78c9bf0e4ab159b25f3db4f2c5N.exe

  • Size

    134KB

  • Sample

    241222-aek8cavmcx

  • MD5

    0e016ef700da2f75e04cdea881bcbde0

  • SHA1

    c77b00e001c8b6411438780da98f4d93ff973b16

  • SHA256

    f9318a57a953b2026f76e7072af47d742ece3f78c9bf0e4ab159b25f3db4f2c5

  • SHA512

    0ad4b8185dab202561581b5daba7e028d36efe7bdf27a3fcb224664468517018f29dd40ba9ea00e5eaac0a72f7b0bd80c9719197677d314e9c50e124b5a141b2

  • SSDEEP

    1536:fDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCit:LiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      f9318a57a953b2026f76e7072af47d742ece3f78c9bf0e4ab159b25f3db4f2c5N.exe

    • Size

      134KB

    • MD5

      0e016ef700da2f75e04cdea881bcbde0

    • SHA1

      c77b00e001c8b6411438780da98f4d93ff973b16

    • SHA256

      f9318a57a953b2026f76e7072af47d742ece3f78c9bf0e4ab159b25f3db4f2c5

    • SHA512

      0ad4b8185dab202561581b5daba7e028d36efe7bdf27a3fcb224664468517018f29dd40ba9ea00e5eaac0a72f7b0bd80c9719197677d314e9c50e124b5a141b2

    • SSDEEP

      1536:fDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCit:LiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks