neconyd | 5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2cc

General

Target

5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe
Size

72KB
MD5

04d2c4577705e658843279c08e96d1d0
SHA1

85118b2aad58bc72d4a1ad385ce6c78ae9bca279
SHA256

5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2cc
SHA512

851ce8325a2c4e67325193aaf97abb75e5feb99d1ed73c3e404f4aaa61266ab398ea41d19bb2e7c8ad0f6179080fe5a541a49a2b026ceae7f635d7b4b56c4b1e
SSDEEP

1536:wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:wdseIOMEZEyFjEOFqTiQm5l/5211

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2428	omsecor.exe
796	omsecor.exe
572	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe
1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe
2428	omsecor.exe
2428	omsecor.exe
796	omsecor.exe
796	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2428	1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe	28
PID 1648 wrote to memory of 2428	1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe	28
PID 1648 wrote to memory of 2428	1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe	28
PID 1648 wrote to memory of 2428	1648	5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe	28
PID 2428 wrote to memory of 796	2428	omsecor.exe	32
PID 2428 wrote to memory of 796	2428	omsecor.exe	32
PID 2428 wrote to memory of 796	2428	omsecor.exe	32
PID 2428 wrote to memory of 796	2428	omsecor.exe	32
PID 796 wrote to memory of 572	796	omsecor.exe	33
PID 796 wrote to memory of 572	796	omsecor.exe	33
PID 796 wrote to memory of 572	796	omsecor.exe	33
PID 796 wrote to memory of 572	796	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe
"C:\Users\Admin\AppData\Local\Temp\5eaa0d56ec971efdef36eb029b243eb8e0a20767ea8548dd0421a4bf4b19e2ccN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
4cb7b44c038bc9127a2b771170bd822b

SHA1
8d13bd371771e428cf351bdd94ffe68225ee8c73

SHA256
f8ff789c93c4a3bb3c3bf2c30536e7fc7b457566084c7fb2bf6a73b06453f081

SHA512
d3c5237ba4da6478ae79406e835a99900c9a9c76b8b419018e19bad092f5e7fa8f0cf3b836f3a8c11ff210973f358369ae7e0dd77a2475d53a1848910aed741f

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
e9977b0b09ab9b816de17a6bd22fdbbe

SHA1
521a2d82794d97bc403eec791ac72687fbbe5c6b

SHA256
5eb5790463ffea5b2d7c32e049306690c00633e371b727b04e2816dafe17488b

SHA512
63df33c1a714380ad6c7501b0ec9440375db789f84534d9d482f8cf52cd7b0539d4d9999bd7d34c14c5e498e04464b321b9cbc6f9f95b72873fa5e4ab52f0da4

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
896329f3e6ae8767515457cf7f996288

SHA1
84a21b1158b953f535b7a8d282f0cf6c030bb7d9

SHA256
96d402f131ec9a05c70b79c2e449a002058554912576c3eecf64e3238a5492a5

SHA512
b9a92eba2d69cb65a28eba771fb04efdba29446e16f4cb153cd5e48847d59a7931362aaf6d8a73069128830006f886da12bda41594d9d782cbc25c9b14d44ae6

Download Submit

Analysis

Sharing