General

  • Target

    c910139737601d416d81760922cbab3f7fc5b009ab7c121b33e92cdd8898fe7eN.exe

  • Size

    96KB

  • Sample

    241226-w213zavjhp

  • MD5

    da97c6e72c9bd21569f357bbb0f30bc0

  • SHA1

    e9dbfc9a7ecd11b4cca28f46053ccfda43e3a502

  • SHA256

    c910139737601d416d81760922cbab3f7fc5b009ab7c121b33e92cdd8898fe7e

  • SHA512

    7f45e174e326a791e9b5f164aae1930b237caeefd2159064f3c796ffc22147c1b7fe0533e6601072b5d772bea61fd5709b403b30dbd1945a502c7bf7a5308673

  • SSDEEP

    1536:2nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:2Gs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      c910139737601d416d81760922cbab3f7fc5b009ab7c121b33e92cdd8898fe7eN.exe

    • Size

      96KB

    • MD5

      da97c6e72c9bd21569f357bbb0f30bc0

    • SHA1

      e9dbfc9a7ecd11b4cca28f46053ccfda43e3a502

    • SHA256

      c910139737601d416d81760922cbab3f7fc5b009ab7c121b33e92cdd8898fe7e

    • SHA512

      7f45e174e326a791e9b5f164aae1930b237caeefd2159064f3c796ffc22147c1b7fe0533e6601072b5d772bea61fd5709b403b30dbd1945a502c7bf7a5308673

    • SSDEEP

      1536:2nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:2Gs8cd8eXlYairZYqMddH13z

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks