neconyd | 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8

General

Target

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Size

71KB
MD5

2304f8a81adeb321a98aad88eb540694
SHA1

982834579ead861d2a40a1b8aa1dc03acd496fb0
SHA256

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8
SHA512

13cca69b385494b10d5fd1215de1176482b1472f8c6ecb8ef3ebd130beffcc70ab7e870a55797d08de70d6966e53857b96da8659ebfa1b2ff41c0e68efdab847
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH/:kdseIOMEZEyFjEOFqTiQmQDHIbH/

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2704	omsecor.exe
1656	omsecor.exe
492	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
2704	omsecor.exe
2704	omsecor.exe
1656	omsecor.exe
1656	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2704	656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 656 wrote to memory of 2704	656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 656 wrote to memory of 2704	656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 656 wrote to memory of 2704	656	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	30
PID 2704 wrote to memory of 1656	2704	omsecor.exe	32
PID 2704 wrote to memory of 1656	2704	omsecor.exe	32
PID 2704 wrote to memory of 1656	2704	omsecor.exe	32
PID 2704 wrote to memory of 1656	2704	omsecor.exe	32
PID 1656 wrote to memory of 492	1656	omsecor.exe	33
PID 1656 wrote to memory of 492	1656	omsecor.exe	33
PID 1656 wrote to memory of 492	1656	omsecor.exe	33
PID 1656 wrote to memory of 492	1656	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
"C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
7e7609f784087520d682a9eba366dab8

SHA1
f77b7b31cd9a716f0e448c006d9e51628a392c60

SHA256
77ff00f5530ee100454c15c431075d0c3794f38d6a647a7dcfefc106e2e7845a

SHA512
4f7737b1fd47cfa844acb70294a72cb3dc15de58a907165136c324e308441f1a78fb6442b7a5062e68e0b3f0d0024a5a0bf6a226758febb68f1c0a3870ad16ef

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
65d3b263d4f66677a4b85a6a877b643b

SHA1
9995c58338b062d08551b8af8d34c7a8737a191e

SHA256
a6cad68193f6fba3d9364c20ddf4e16643229df4c0058b61f9d1f1ead0c8382b

SHA512
494e5dfff7c1625ac5c02b96746ad936c00dee5da556a713221acdb88ef9b757ad2ae076df1705be333b6d4d02c02861c649c76bfe051bc37b8b546aa7587feb

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
32b4ac68537ce4d939dfa4d1ce886feb

SHA1
06b023f8f854e8f29083d4a344827b7ffa593a16

SHA256
1ee7568ce21aa4b315269d8de4cc22764447a632502d0493d7c6f01b0c23330d

SHA512
7ed275641c154afc71fd167c640c15089a2c578dbfa97686d6c1c312eddb2a41802d97ec82341819b6d6d10b5c170c8232d66236ae5e5636bcb64368ec1dd32e

Download Submit
memory/492-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/492-37-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/656-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1656-28-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1656-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2704-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2704-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2704-16-0x0000000000330000-0x000000000035B000-memory.dmp

Filesize
172KB

Download
memory/2704-22-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing