neconyd | 469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c

General

Target

469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe
Size

80KB
MD5

2209e6abb473b890cb413f8a02d969e8
SHA1

370459728393e67bb3416dd7f418613699b9ab92
SHA256

469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c
SHA512

4dcd5aca3fe607a66b4628ca550a6dd697150b81f24a58368855662e99ffc29419b33766a2c98b89d8c629803fbefd4054f3015af52f15ed34a1f3341e7a4a86
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzB:kdseIOMEZEyFjEOFqTiQmOl/5xPvwN

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3008	omsecor.exe
1408	omsecor.exe
1412	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe
1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe
3008	omsecor.exe
3008	omsecor.exe
1408	omsecor.exe
1408	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3008	1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe	31
PID 1672 wrote to memory of 3008	1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe	31
PID 1672 wrote to memory of 3008	1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe	31
PID 1672 wrote to memory of 3008	1672	469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe	31
PID 3008 wrote to memory of 1408	3008	omsecor.exe	33
PID 3008 wrote to memory of 1408	3008	omsecor.exe	33
PID 3008 wrote to memory of 1408	3008	omsecor.exe	33
PID 3008 wrote to memory of 1408	3008	omsecor.exe	33
PID 1408 wrote to memory of 1412	1408	omsecor.exe	34
PID 1408 wrote to memory of 1412	1408	omsecor.exe	34
PID 1408 wrote to memory of 1412	1408	omsecor.exe	34
PID 1408 wrote to memory of 1412	1408	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe
"C:\Users\Admin\AppData\Local\Temp\469a77e3f5fef3c474a7acc25c4f55f62d4272574ae293ebc9a7fee2db15fe4c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
07d9b0ecaf47317cc30b4941dbe2c44e

SHA1
ca59db74b49e14215c01e1bf3a396626018a261e

SHA256
3a58477e0b10e1fe4940226333100a673c6aa034753d5cefbb920046c9315c3d

SHA512
3ee698e638bcec592ca2402e778bd262324b2cd32e59cbc7371a8d8727bfe16af255c81a72a094393a85e2f1ebd688ef63e95e02ed931754e86e0fcc286ac1be

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
57680c8344c52ab5fe3d42053c7c4086

SHA1
b43e9279c2950acf4998abd046802f3934cde343

SHA256
8f051863afac06c46985d5e23632f4f2aca18b4bed4d1303b91a2e8216da11d1

SHA512
f7236a0073cf9dc8f4ccdb9e30d979bc132e3400b676d7cf4178cd6250948b66b68cd6027e2e186ce7d96ca7fc2bf03e7d9d847f4741293d994f338347d5b0d3

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
cf0fcaf014b0d453deda6b657584b141

SHA1
a5ba860eff86a22f5d05116d900f4c2122132c88

SHA256
ca09ec7a5eef5ab4289879eac84c1a959bc57c7c369622a8af7600ece4c0ab3b

SHA512
0dcf3b4f3f0e250844c6705efe0d64fa7634319c1d978b29f68abea6104597dd457b070e39cb293d7ad4249138db9aef9af0a16c0d72786ee49f226cbc23ecf0

Download Submit

Analysis

Sharing