neconyd | f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22

General

Target

f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe
Size

89KB
MD5

953b5dcbee95440d38892ee7f4c84e50
SHA1

bad61f40f24102dc184116dbe839547816ba020f
SHA256

f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22
SHA512

5e9ffe005d1e3e383d9a6fc1b9892d734bd7a6ecc38b983a2136aed43aab1a0f754e277b1b66876056925fdd6b584b545ccddb5a0fe9bc1ac7b2b1a89becd0c4
SSDEEP

768:FMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAV:FbIvYvZEyFKF6N4yS+AQmZTl/59

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1044	omsecor.exe
352	omsecor.exe
1320	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe
2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe
1044	omsecor.exe
1044	omsecor.exe
352	omsecor.exe
352	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1044	2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe	31
PID 2452 wrote to memory of 1044	2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe	31
PID 2452 wrote to memory of 1044	2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe	31
PID 2452 wrote to memory of 1044	2452	f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe	31
PID 1044 wrote to memory of 352	1044	omsecor.exe	34
PID 1044 wrote to memory of 352	1044	omsecor.exe	34
PID 1044 wrote to memory of 352	1044	omsecor.exe	34
PID 1044 wrote to memory of 352	1044	omsecor.exe	34
PID 352 wrote to memory of 1320	352	omsecor.exe	35
PID 352 wrote to memory of 1320	352	omsecor.exe	35
PID 352 wrote to memory of 1320	352	omsecor.exe	35
PID 352 wrote to memory of 1320	352	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe
"C:\Users\Admin\AppData\Local\Temp\f05d38f591adb596fc1c2e257be265bb3e458d4ebf0b60920ec2558343cadc22N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
67f1215eef7668f862d48acf41ae7e5d

SHA1
4a6828e76a3032f83f0f262425f18aacd628bfde

SHA256
af281d31c48a2aaeb0dc8fd8bc496fcd8f146cc84f9905e6bece20108c9ab01f

SHA512
807b5c8b17672ee6b332e99a338bb8136719a14625504ddf7b258326a085814f660f88b982f2448dc50b45680629652c868f11e93ae1c9583691df588f29b760

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
cb4560e3e9c27c926f3799f376c064f7

SHA1
84398990de67c96231dd352f907f0da3060aac2e

SHA256
9d0b3f059107e64a865e9445c1b511c2b471274d0526ae700f9bba577a6fa0dd

SHA512
56db3fc84dc6abe574ae3fe9c7779f36835304616ffa8705f357c516d7c1ddfc1d93ef6997091d77dbb5f4d56cc4f2bec4b9295b28c590ab7d259e8989133f70

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
fe07386e6e4077b0390d66f0de3934ce

SHA1
bd5c1ceaee0460c2fba4717fa369b18586160ae1

SHA256
52917b80d39df3676a3b6ac55c16eba8ec56abb193432be674985ee30132b719

SHA512
b92d557eb3c8f75a53feaf0d87acc14640f82dd46b88c458ae5acd1955ea72e0c168a7f48a5c5bd3301c2d7ef03db5f39d63c60ab9e40b13a936ed857dc43e1b

Download Submit

Analysis

Sharing