neconyd | 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8

General

Target

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Size

71KB
MD5

2304f8a81adeb321a98aad88eb540694
SHA1

982834579ead861d2a40a1b8aa1dc03acd496fb0
SHA256

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8
SHA512

13cca69b385494b10d5fd1215de1176482b1472f8c6ecb8ef3ebd130beffcc70ab7e870a55797d08de70d6966e53857b96da8659ebfa1b2ff41c0e68efdab847
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH/:kdseIOMEZEyFjEOFqTiQmQDHIbH/

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2776	omsecor.exe
1692	omsecor.exe
1748	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
2776	omsecor.exe
2776	omsecor.exe
1692	omsecor.exe
1692	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2776	2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 2076 wrote to memory of 2776	2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 2076 wrote to memory of 2776	2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 2076 wrote to memory of 2776	2076	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 2776 wrote to memory of 1692	2776	omsecor.exe	32
PID 2776 wrote to memory of 1692	2776	omsecor.exe	32
PID 2776 wrote to memory of 1692	2776	omsecor.exe	32
PID 2776 wrote to memory of 1692	2776	omsecor.exe	32
PID 1692 wrote to memory of 1748	1692	omsecor.exe	33
PID 1692 wrote to memory of 1748	1692	omsecor.exe	33
PID 1692 wrote to memory of 1748	1692	omsecor.exe	33
PID 1692 wrote to memory of 1748	1692	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
"C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
7e7609f784087520d682a9eba366dab8

SHA1
f77b7b31cd9a716f0e448c006d9e51628a392c60

SHA256
77ff00f5530ee100454c15c431075d0c3794f38d6a647a7dcfefc106e2e7845a

SHA512
4f7737b1fd47cfa844acb70294a72cb3dc15de58a907165136c324e308441f1a78fb6442b7a5062e68e0b3f0d0024a5a0bf6a226758febb68f1c0a3870ad16ef

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
69924c76321ce1347675a071b75826b0

SHA1
fd10596b96d44a1b0a85f8233ca0c890f02ec74a

SHA256
40c488baedc93b02b0eef845272500621c2af17092e0a4436c14bdef78e87ef1

SHA512
5c7e7fcd53f50a37e099a680f1d9b02959bb721275c2c95a49ecd1cf62356dd52f0fc66b6061a47490f144ec091c8fa739469293f3c053f6c43355f679f9b67a

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
1219dcc242840afc026303493f928d41

SHA1
f628333e63a080dc66f9faacd646e78890527b82

SHA256
2458c5fd589111df0568226c1087d4cdcdbd5b29d0f0ceb27e116195f22f541c

SHA512
14eaa4f7b08e95b9cafe84db8607a7041fba8486580e9b4f06368a985c4d55f3fd588bb3a91c0e0fa15935d20fc09091bf58b28a667a1c6c78b1ff2a2dbf76d1

Download Submit
memory/1692-35-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1692-28-0x00000000001B0000-0x00000000001DB000-memory.dmp

Filesize
172KB

Download
memory/1748-38-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1748-37-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2076-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2776-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2776-22-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2776-23-0x0000000000280000-0x00000000002AB000-memory.dmp

Filesize
172KB

Download
memory/2776-16-0x0000000000280000-0x00000000002AB000-memory.dmp

Filesize
172KB

Download
memory/2776-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing