neconyd | dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7

General

Target

dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
Size

88KB
MD5

ed6c1c56b223241e48bb38a0cdd33264
SHA1

ef87d012708914fe10109c7c1fde341c6f7070e6
SHA256

dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7
SHA512

7b53883d732ba8f3104b69c26e04429ecc0e2b5dc2de546d5443d7a17667f7a9a949b6d5449aeb896e1e23aae923e3dc14661eb4ab64bf4bc804e4bd6ba843b7
SSDEEP

1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5h:0dseIOMEZEyFjEOFqTiQm5l/5h

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2300	omsecor.exe
1724	omsecor.exe
2668	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
2300	omsecor.exe
2300	omsecor.exe
1724	omsecor.exe
1724	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2300	2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	30
PID 2384 wrote to memory of 2300	2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	30
PID 2384 wrote to memory of 2300	2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	30
PID 2384 wrote to memory of 2300	2384	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	30
PID 2300 wrote to memory of 1724	2300	omsecor.exe	33
PID 2300 wrote to memory of 1724	2300	omsecor.exe	33
PID 2300 wrote to memory of 1724	2300	omsecor.exe	33
PID 2300 wrote to memory of 1724	2300	omsecor.exe	33
PID 1724 wrote to memory of 2668	1724	omsecor.exe	34
PID 1724 wrote to memory of 2668	1724	omsecor.exe	34
PID 1724 wrote to memory of 2668	1724	omsecor.exe	34
PID 1724 wrote to memory of 2668	1724	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
"C:\Users\Admin\AppData\Local\Temp\dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
33ccc4b44086f2433d345ec98ec8b316

SHA1
61f6c892b573419534e1f50c77523bda404a1c11

SHA256
c96cb145446f4380e5baba680bab98ab8a190d4b7ccbc63b830912a4a1c5f7ed

SHA512
97745afc789bfa165be0825b62fabf69cd1f00ffa02f427e9622aa28a080bd9e8379b931897560127b758d39fea873d5ddcf4308982680ca5152a1dd350c8016

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
8226f174ade122c825aa0c9cb1e13d2d

SHA1
bcc4048f02f75f61ac75a6a553cd31ddabf8bac6

SHA256
a3f223d23dc65d2abb04a4a8c1266d9a86d3e1e5e3a05bd7233beb30572d82d8

SHA512
6e70741adfeee0fa874c479172e308b553f3dd0999cce9a28c65376ce860e5684d17f191657dba448466fcfd2558b5dd18509fe98591fcc839b6cb2d5e575a45

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
6ea81169ab76d40694d810e5ca59161a

SHA1
dc60d5f9eec1320f8a06cfb726bbe066735353ec

SHA256
e2c267166a658aa98b042299135d8b65b6753fbaf1b1e437d62018597eea7644

SHA512
c047cdc5a44329d95ba6d85694000777814b5c1af7fd395ebe62c138a17955873f016e87132e78a08b3666d5fca16c698da1edc5df83b352bfc994dbd594a6ab

Download Submit

Analysis

Sharing