General

  • Target

    cc085275dc948ac3e09eb20bceaa471518175a0ce7e8122bf97d64bf393c7c18.exe

  • Size

    134KB

  • Sample

    241231-garmwsxjhk

  • MD5

    8d074aebb35db37fa02fc5d476e7ad59

  • SHA1

    40ed0d486d32072df7027a71088816c22560a3de

  • SHA256

    cc085275dc948ac3e09eb20bceaa471518175a0ce7e8122bf97d64bf393c7c18

  • SHA512

    3ba0c94ed1ffb469c73614867e5c808c68fc3a1b5efdd923a63b0ee02d36545f6bc1b61d43fbed78fa09606639fbbd2dc2570e6996337f20ef0618cabdf7a6e9

  • SSDEEP

    1536:BDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCit:hiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      cc085275dc948ac3e09eb20bceaa471518175a0ce7e8122bf97d64bf393c7c18.exe

    • Size

      134KB

    • MD5

      8d074aebb35db37fa02fc5d476e7ad59

    • SHA1

      40ed0d486d32072df7027a71088816c22560a3de

    • SHA256

      cc085275dc948ac3e09eb20bceaa471518175a0ce7e8122bf97d64bf393c7c18

    • SHA512

      3ba0c94ed1ffb469c73614867e5c808c68fc3a1b5efdd923a63b0ee02d36545f6bc1b61d43fbed78fa09606639fbbd2dc2570e6996337f20ef0618cabdf7a6e9

    • SSDEEP

      1536:BDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCit:hiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks