neconyd | 5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7

General

Target

5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe
Size

80KB
MD5

99014557fca57e87caf8bc0b2d017360
SHA1

ddf4e5972878a2a101a5290acef5da9b285a8c11
SHA256

5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7
SHA512

b0aa176a40e9370cd106552ad3994fdf56c34416f0905553d52ff80c03659cae5916bb3113eddb1364d791e4ece4ea076d438ae705c4b916720bd158e6a8735a
SSDEEP

1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzJ:4dseIOMEZEyFjEOFqTiQmOl/5xPvwV

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2124	omsecor.exe
2852	omsecor.exe
3012	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe
1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe
2124	omsecor.exe
2124	omsecor.exe
2852	omsecor.exe
2852	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2124	1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe	28
PID 1672 wrote to memory of 2124	1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe	28
PID 1672 wrote to memory of 2124	1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe	28
PID 1672 wrote to memory of 2124	1672	5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe	28
PID 2124 wrote to memory of 2852	2124	omsecor.exe	32
PID 2124 wrote to memory of 2852	2124	omsecor.exe	32
PID 2124 wrote to memory of 2852	2124	omsecor.exe	32
PID 2124 wrote to memory of 2852	2124	omsecor.exe	32
PID 2852 wrote to memory of 3012	2852	omsecor.exe	33
PID 2852 wrote to memory of 3012	2852	omsecor.exe	33
PID 2852 wrote to memory of 3012	2852	omsecor.exe	33
PID 2852 wrote to memory of 3012	2852	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe
"C:\Users\Admin\AppData\Local\Temp\5fd393289d24ca3bfd9977cc9f0f2cdd1bef9ec6f5a0789c60864ed9dc0a69e7N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
653966adf72b0514c04606788098660a

SHA1
94beb135cbd3a5b714d19f1abc445ffe449e9629

SHA256
aeb491e663cc6ab99328e03a7e44fd6201acc445a73b5f052ad675ded0950ab6

SHA512
98af5a9616125fbc2e923deb0735996bde49bc7b168af4abba19ddaa6b95f7cb182caa2fb6eb1d59c63c02a1a7785f8bd924024a70efe6fb6c080bda3cb73187

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
22c8effc4f31dea8177711462f49f291

SHA1
18df5780c68160bffd34d1d16341308aa20c12d8

SHA256
493771623bbc166ea5fdb536c57c79e89a9b750e336d4c700108eb72adc4d647

SHA512
5935b19cb577d9c2819bddc9ace4c0ae885204482383dc20dbd819ee46b20ae26b79f92bf7b1eda61c0ee600621ec758706699ec3b33cc191b7545d18258f809

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
66a6f3da0f7663de8eff499e06287026

SHA1
0dfa4d3635f0f9bb948061ee1c3832b97a49fd03

SHA256
f9faa87e416b66bc497154958a9488852c78fc0b2056ccc08537d67b8bf50b9a

SHA512
84d49aeebee93e9cd32c186c93f7ce66a53447945681c8d8075b1fd007ef592ee2b7d44f8426fb80ea900cf09b31778745f64be8bbbea86ff25a5795a4c4585c

Download Submit

Analysis

Sharing