neconyd | 4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4

General

Target

4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
Size

65KB
MD5

48bd7132d989b48d0a6b8766d77f4b60
SHA1

c47d9b3d79e7cf24e0ad87342491a089e1e3442c
SHA256

4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4
SHA512

2cbddb5444d2fb3489bc25b3d54b84dc3b7ec2cc3d6ad5cad04356b8c415b2233463048fdc81b2c04c73d449cd0d2e102257093bf4d492c6ec589208827774fe
SSDEEP

1536:/d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:3dseIO+EZEyFjEOFqTiQmRHz

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1660	omsecor.exe
2956	omsecor.exe
2324	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
1660	omsecor.exe
1660	omsecor.exe
2956	omsecor.exe
2956	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1660	2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	30
PID 2112 wrote to memory of 1660	2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	30
PID 2112 wrote to memory of 1660	2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	30
PID 2112 wrote to memory of 1660	2112	4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe	30
PID 1660 wrote to memory of 2956	1660	omsecor.exe	33
PID 1660 wrote to memory of 2956	1660	omsecor.exe	33
PID 1660 wrote to memory of 2956	1660	omsecor.exe	33
PID 1660 wrote to memory of 2956	1660	omsecor.exe	33
PID 2956 wrote to memory of 2324	2956	omsecor.exe	34
PID 2956 wrote to memory of 2324	2956	omsecor.exe	34
PID 2956 wrote to memory of 2324	2956	omsecor.exe	34
PID 2956 wrote to memory of 2324	2956	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe
"C:\Users\Admin\AppData\Local\Temp\4bf14d759489e666413b9c907a26aa9edaee72af6499f69c74b6f490fbab7fb4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
d2ed645ab6d2e2466c6102f27813da7c

SHA1
90e79c6b468dc4e3f0784e7086580c98bd4edce4

SHA256
94dba6a2f14665beeee3a0cbf2761338fedb41f5d1b7b7e552b901c9853b1806

SHA512
565429d9f033061ff74ebea010979d95978b8ac7c37d7eef5e8adaa0cbf8af29b6dfdd35f2848393ed62a335dbf51ef35798a6499ba40c769fa47afa6d57ad5a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
44ff4bff68af2dbb15924b8cd2f3fc72

SHA1
384140542557e13729e8ac04702629bf2565ed6e

SHA256
493dda7c81fd3974d60fd710b5f000429ab685ffd132d78b3370d601397f0126

SHA512
d65dbac29a0b14145f138c553dac161c19ba0feb940f1626caf88c8d88fab44d6a2f4219589f7d0585ce0b5ac33a2231235e2da81c61ba4fdb0a22fa73fc9a47

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
6525d2208ad4ec664c092453ea03e092

SHA1
d211979c4faa87522f19aee2772a7e3d6ae39b89

SHA256
89a2a939d4437280994f8b60ce6704a589c24f06c645a4601c8b76ed0036c012

SHA512
f6023ec12038ac6e9b871a790c5749b911b953d0851316b636d7c08beb1a81477d51263701067a0e5e18af1e30bc3df2fdf95229803fe009bf8e1aab0417c765

Download Submit
memory/1660-24-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1660-25-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1660-41-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1660-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1660-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-9-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/2112-8-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/2324-40-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2324-42-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2956-32-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/2956-37-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing