neconyd | 6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158

General

Target

6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
Size

88KB
MD5

4653f45619e769536486e5fe5d4eb5b5
SHA1

6a85b37d118bb869a56251021a2d19b1c38e57b5
SHA256

6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158
SHA512

5b990d00d09de08a1ded568bd708702a05cf667fb77891ef6633f44f0f3af0b4cf562ddb6c402c9025964b1d89d2f636465cae6becf7ba1df3f262ff8b751fdb
SSDEEP

1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5Z:bdseIOMEZEyFjEOFqTiQm5l/5Z

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2580	omsecor.exe
524	omsecor.exe
1676	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
2580	omsecor.exe
2580	omsecor.exe
524	omsecor.exe
524	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2580	2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	30
PID 2128 wrote to memory of 2580	2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	30
PID 2128 wrote to memory of 2580	2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	30
PID 2128 wrote to memory of 2580	2128	6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe	30
PID 2580 wrote to memory of 524	2580	omsecor.exe	33
PID 2580 wrote to memory of 524	2580	omsecor.exe	33
PID 2580 wrote to memory of 524	2580	omsecor.exe	33
PID 2580 wrote to memory of 524	2580	omsecor.exe	33
PID 524 wrote to memory of 1676	524	omsecor.exe	34
PID 524 wrote to memory of 1676	524	omsecor.exe	34
PID 524 wrote to memory of 1676	524	omsecor.exe	34
PID 524 wrote to memory of 1676	524	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe
"C:\Users\Admin\AppData\Local\Temp\6aa51a08107dc1916acb2fd545a1b870373a00d8d38ad030638ca83ff65e7158.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:524
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
1dc078ba12d431de5fcb0c940326bd4d

SHA1
cad4602e023d59f3dd3e4c6555a37290612f169e

SHA256
547e440f213cca6496b5b68fe109e45455a242443a6d3fac5c6949550344ff08

SHA512
e7a91660829ba746e057ce7905968ae9f794855f35fb720424f33a281728b3879b70691d08469f32725337368aa8952d139fb9b71ecb87cf47df21c1a1badae2

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
4daa0243d120d1786a313dd605edd98a

SHA1
ca3eb38590b8ae7929921d549266ed9fdbdde278

SHA256
5bf7c9c71081265705cf3987c8b2f8339df80a45a9e6e0b3a9e758c497215089

SHA512
f6e2d77ac6477594a8fac3a736e4e45ed1a52affdfb979ea1efeda4537865b559bb08e04769e15fa507c9d0612e23f358e85ffad1873606af009829522263b6d

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
80930a37048c059c5fee7bb5ce5e63d9

SHA1
d1354b58b519416f53a65857d5619e7b541bc389

SHA256
e7637e94bbb4d42ddb5ad4e6df81eeeb5735c85ef1c8665fbe818c6810dab587

SHA512
6f41f964b2c19baf8309ba5290f88b826fc4c6dc1136c735fceaf596c7dc5fe3e62ec42a75a7f01c4198bc84bac3f071e2dc7160df88896cc6f522a809469023

Download Submit

Analysis

Sharing