neconyd | 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68f

General

Target

1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
Size

64KB
MD5

1c00754a0728f9946163179cd190a080
SHA1

0504aceeeb0b1222f75812d2c249c760d88d9057
SHA256

1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68f
SHA512

ed35381ab962862d60a038c284311275e04ccb552212e35902d2f0e7384313077d072e986689003d37141891ebd3e7740c16119780ed8b36980228e919891894
SSDEEP

768:vMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:vbIvYvZEyFKF6N4yS+AQmZcl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1864	omsecor.exe
572	omsecor.exe
1992	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
1864	omsecor.exe
1864	omsecor.exe
572	omsecor.exe
572	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1864	2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe	30
PID 2360 wrote to memory of 1864	2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe	30
PID 2360 wrote to memory of 1864	2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe	30
PID 2360 wrote to memory of 1864	2360	1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe	30
PID 1864 wrote to memory of 572	1864	omsecor.exe	33
PID 1864 wrote to memory of 572	1864	omsecor.exe	33
PID 1864 wrote to memory of 572	1864	omsecor.exe	33
PID 1864 wrote to memory of 572	1864	omsecor.exe	33
PID 572 wrote to memory of 1992	572	omsecor.exe	34
PID 572 wrote to memory of 1992	572	omsecor.exe	34
PID 572 wrote to memory of 1992	572	omsecor.exe	34
PID 572 wrote to memory of 1992	572	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
"C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
f586ef171233b30b9ac0f02ada39fbda

SHA1
4ed27f06ece9fc0dc5155cc0a4829b58f528801f

SHA256
4a7edcd4104679f56d3ffce668750abae64a329b3d75e1685f41f0632b7af397

SHA512
651c50c5848c201d48a2914fd4554a270e1895414ca529b04ec69e2b5b75aae759f1090d7671157ffdb13c3aaa6e6dcc3d2dc16284594c9a034e3d8b1dad0f87

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
49b5b6235cc0f39fdc386f5a1bb4554e

SHA1
fa7bbf1e776e6be7d49b468f572e146e6c6629c6

SHA256
801c01d0dd0caf8742bb80a9a7c300ccb5428268292bfa14818f51855847336b

SHA512
e734d69d422f50157b4e218172c2a6b407c6d5349f57bfd99642d4c1b5688d0e1f016d485f22b6fcd289f2160126ec6973181d21a3064ec13f8e3512be32b684

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
0de52a1b380b6460ab675f1b06bb6421

SHA1
86e8951afcc24e9ff163eb895e04214f99e24a4c

SHA256
7fdbf3dbb145009668c993a1bd5d6be050d56fad623faff081129e2d5d133359

SHA512
43b0f4e1e38b46eef154bc6d8f623f236bf385ba479fda184f9b95b1b8509a97bff308d9e384aed5808967bb42be75f0529578a752b4ee938dfa14e5842aac8e

Download Submit

Analysis

Sharing