neconyd | 4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d

General

Target

4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
Size

89KB
MD5

69c5169baa9780b5e5b62c91577950f6
SHA1

7f9c4ca75619783d4b255b692d5f2c0a70c80ad5
SHA256

4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d
SHA512

5d8a9b219f6e7eb5f88fbf760ffa649184d6d95b46774e922f0154b43502dc4269bb0198847340caf2f11aaacb86faa8b0ab368873c095ac3c3c5b1984b5e900
SSDEEP

768:7MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA/:7bIvYvZEyFKF6N4yS+AQmZTl/53

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2072	omsecor.exe
2652	omsecor.exe
3028	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
2072	omsecor.exe
2072	omsecor.exe
2652	omsecor.exe
2652	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2072	1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	30
PID 1792 wrote to memory of 2072	1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	30
PID 1792 wrote to memory of 2072	1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	30
PID 1792 wrote to memory of 2072	1792	4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe	30
PID 2072 wrote to memory of 2652	2072	omsecor.exe	33
PID 2072 wrote to memory of 2652	2072	omsecor.exe	33
PID 2072 wrote to memory of 2652	2072	omsecor.exe	33
PID 2072 wrote to memory of 2652	2072	omsecor.exe	33
PID 2652 wrote to memory of 3028	2652	omsecor.exe	34
PID 2652 wrote to memory of 3028	2652	omsecor.exe	34
PID 2652 wrote to memory of 3028	2652	omsecor.exe	34
PID 2652 wrote to memory of 3028	2652	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe
"C:\Users\Admin\AppData\Local\Temp\4f6052ae72b632ec6423f2237b599eb93ec605b68f69005ea3c7d8eb5307308d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
b541d1c45b1630570bd0a168fb96b126

SHA1
19f88ec04356cc6ffbbac4dfebef78983ed95092

SHA256
924ac86434eb52aef7e7f8316e37e6f41530d000395b434777197e2b78923559

SHA512
48a8ce8a0911bcafbde2f44f2e1a203d14dd62804f5979ce23d951bfb3f1c0100b0f3308de56263ebf2115bcae91311ef3d7863d47b7f440706291de9dcbc008

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
12bd25aa8b6b689283fb0f0711de4afd

SHA1
42e3324bc69754c25363f7069fa46b17f2e4ceb0

SHA256
df1e82f9659eea09447fd42d01db3d0f608cf156f17956305ec2221f94b8a90f

SHA512
14839a1caeada12a2c413e76aa6df14c5057ab8bb338697b29d320bb6dacd521b3ca5a21f1ea36710e72f0303ae55dc20bf69512b87f2c8fc26ca337fb72a5b4

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
b4e1ecd5dc8819d9006d37d430c74a6d

SHA1
6afcfaa67dafd861cd0bbef8a7bff2e89c706c26

SHA256
29f402864dd10fd6b972093a793d5b9e3fbb4211380bdb970fcb58aeb5f8931d

SHA512
fff586084e062658067ddfe1230b15c8167cda7053978f16e6089a7fd27cfe7b02be98f1cfee84c6a51016a93d1b67d43eb034ef4111880c21efde5f1f8691f7

Download Submit

Analysis

Sharing