neconyd | d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9

General

Target

d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe
Size

80KB
MD5

49c76a7a1ea459734125a3b2f70b6c40
SHA1

2eabb00bdbea6f9b6e1e5fd86bd905de0e12dc61
SHA256

d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9
SHA512

2e74e18e163098125b5c29323d5d7c1c4745ab763655bdc0e82849544111a36b42e360f0bad6c47a6b306fc09d5a4de30f00e19a422de7d0140d4311b160788d
SSDEEP

768:efMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA6:efbIvYvZEyFKF6N4yS+AQmZTl/5i

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2812	omsecor.exe
1740	omsecor.exe
1704	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe
2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe
2812	omsecor.exe
2812	omsecor.exe
1740	omsecor.exe
1740	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2812	2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe	30
PID 2372 wrote to memory of 2812	2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe	30
PID 2372 wrote to memory of 2812	2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe	30
PID 2372 wrote to memory of 2812	2372	d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe	30
PID 2812 wrote to memory of 1740	2812	omsecor.exe	33
PID 2812 wrote to memory of 1740	2812	omsecor.exe	33
PID 2812 wrote to memory of 1740	2812	omsecor.exe	33
PID 2812 wrote to memory of 1740	2812	omsecor.exe	33
PID 1740 wrote to memory of 1704	1740	omsecor.exe	34
PID 1740 wrote to memory of 1704	1740	omsecor.exe	34
PID 1740 wrote to memory of 1704	1740	omsecor.exe	34
PID 1740 wrote to memory of 1704	1740	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe
"C:\Users\Admin\AppData\Local\Temp\d8d7683a26729d1fe62e5796a0815d53b7d147a18ad36e07409836024137b6b9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
4d93b2f3da8437833f957c6be2e3755d

SHA1
f1dba489ceabf8e99412e979686de7a479227aa2

SHA256
2b5e2cd9057121a89f8047cb6ea98fefe8606fc234393aec319e08c1d3be3c13

SHA512
a7a103620211ea109b4d030e578835b324c07d96b3cd81cc0714ea4ce45566034afe59b509a51cf608e0485708863b556d9a93c0c91c987e63423b0474dfe37c

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
26375c05e73228b7f02e6f1d009473fc

SHA1
2937b19599da9bc4538b9399c7fd51c951c5259f

SHA256
2df57337df455da71b534e1fc55bf9ed368f83ec80a2fe48a57b3209467ea776

SHA512
7a59b1d79f7a650357560ff56dfe141869054672d990f014d1b821b0f6556ae327099439b1788e6c4513a7ed938414b3de227445537e0005a34be24408703b02

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
07df79391abe5e4e841e654c44ff7211

SHA1
ff069333fda7322e3630a6d610df7c7e6d9dd91c

SHA256
0be13c18509836e235d3c518b0e5d683730f4c6a04e532397d951679bc107303

SHA512
fcbdbbb76b8a2baacfe217c856f9cd0ce4daf79388c70778d537842d97410ea7b4784c568d1ea2beb4b8b65a8bdc01a7a2f48b9f76c0bee60f938a3b77cf508d

Download Submit

Analysis

Sharing