neconyd | 65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3

General

Target

65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
Size

33KB
MD5

b4fb7aa55093dabeb9843970eb9914d1
SHA1

bb1aab0f590f8771b286ff584da3ad6000a7fdf1
SHA256

65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3
SHA512

1bf4345bd11957f2a66000b8a5253970ab2cc275d83d83ab035a56da6bad87b1607af3d1d29af8a2606ea1da9247478f2913bf89ea009c97ba467d563a0f55e1
SSDEEP

768:/fVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D/:/fVRztyHo8QNHTk0qE5fslvN/956qo

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2404	omsecor.exe
3040	omsecor.exe
2640	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
2404	omsecor.exe
2404	omsecor.exe
3040	omsecor.exe
3040	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2404	2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	28
PID 2252 wrote to memory of 2404	2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	28
PID 2252 wrote to memory of 2404	2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	28
PID 2252 wrote to memory of 2404	2252	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	28
PID 2404 wrote to memory of 3040	2404	omsecor.exe	32
PID 2404 wrote to memory of 3040	2404	omsecor.exe	32
PID 2404 wrote to memory of 3040	2404	omsecor.exe	32
PID 2404 wrote to memory of 3040	2404	omsecor.exe	32
PID 3040 wrote to memory of 2640	3040	omsecor.exe	33
PID 3040 wrote to memory of 2640	3040	omsecor.exe	33
PID 3040 wrote to memory of 2640	3040	omsecor.exe	33
PID 3040 wrote to memory of 2640	3040	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
"C:\Users\Admin\AppData\Local\Temp\65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
e93700c04a2acca4562f5e8bc520dfe2

SHA1
36a38201996dd8f8a45497c2e02faa421366dfc0

SHA256
b3f090aea96180d067de8acbd2ba30d89e70c9ae74fd281434e9b04be29b10ff

SHA512
02793a34a59bf4bf1f854a812e513e8122fe63d4c32cdbc21217c6924f7809667c77d4a212b6e365be67e6b641a2dac1ca03036fb206e64ef40368108a69811d

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
05b3e78915db7da213e045be9518e40c

SHA1
ea927359e84154e59ac087ef6d288af8a79f2d92

SHA256
b35e0e14f2dd71c458c332bf2edfafe08924c5552ed0c4e2b0eca950826f3cf1

SHA512
0c11db64cdda1eda4fce81aa0cb4e517d856d1944e040be96e07108c65dd9272a7e11d967df05212a63abef42080bbbac7bb7e3c082b82f405118f6963184ea3

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
33KB

MD5
ae66f931fc5b6b423d3ee902e86a35db

SHA1
b7062d7a048b0a6c152a76d672622415f410ad4f

SHA256
042a0d23e141a31019a18a748749e99e1172a8f4a3b67f4cbb85a3237b161aea

SHA512
1c9832693491786b319841c24a0fc3480296d7dbe357ca4d3b7e8c066805710ad6d1c8b0958a9aa59874678277818900bde8b4275e12d7765de8b11ece08cc51

Download Submit
memory/2252-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2252-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-33-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-27-0x0000000001F60000-0x0000000001F8A000-memory.dmp

Filesize
168KB

Download
memory/2404-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-47-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-49-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3040-39-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/3040-45-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing