neconyd | 91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91

General

Target

91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe
Size

248KB
MD5

3e1818397961440efac98af4cf7752a5
SHA1

b0069a8bcc564240d26eab05eff95afb5a101bf9
SHA256

91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91
SHA512

e7767ba16c93f2e77d69db25b19d2ca2f27dbb11069d106939e0d9cf7b3118ae895ce087c882d7e5be1c5cc2fb12ad199739034408d1c4bd15d642f64b663023
SSDEEP

1536:a4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzUr:aIdseIO+EZEyFjEOFqTiQmGnOHjzUr

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1140	omsecor.exe
476	omsecor.exe
2960	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe
2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe
1140	omsecor.exe
1140	omsecor.exe
476	omsecor.exe
476	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x000b000000012259-9.dat	upx
behavioral1/memory/1140-11-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2312-8-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1140-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-16.dat	upx
behavioral1/memory/1140-26-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/476-25-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/476-37-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x000b000000012259-36.dat	upx
behavioral1/memory/2960-38-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/476-31-0x0000000000230000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2960-40-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1140	2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe	30
PID 2312 wrote to memory of 1140	2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe	30
PID 2312 wrote to memory of 1140	2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe	30
PID 2312 wrote to memory of 1140	2312	91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe	30
PID 1140 wrote to memory of 476	1140	omsecor.exe	33
PID 1140 wrote to memory of 476	1140	omsecor.exe	33
PID 1140 wrote to memory of 476	1140	omsecor.exe	33
PID 1140 wrote to memory of 476	1140	omsecor.exe	33
PID 476 wrote to memory of 2960	476	omsecor.exe	34
PID 476 wrote to memory of 2960	476	omsecor.exe	34
PID 476 wrote to memory of 2960	476	omsecor.exe	34
PID 476 wrote to memory of 2960	476	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe
"C:\Users\Admin\AppData\Local\Temp\91697091bd716dfbc65721f0bc80216b71f56099baeb73ce68957156d5f99c91.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
248KB

MD5
93f6a92522fab5575a69152903f2c2ef

SHA1
b29559a0732af9f514d39badc25b3bbe023252f5

SHA256
2633ece9a8bc1dc0dfdf1a3210b45bbae525f80ba24fb05a15b9c412c53960ef

SHA512
d0052fddfa536275b21244f19188d0747abcaa631d861e08e70b312dad5dff470749cc5d0dea957649cec0e2910488849b6b0f41b6e2362b7082967b6a85c0ae

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
248KB

MD5
5f903b457bbb181939be41196d947c21

SHA1
6e8a7378eebcd705aecb2354e27c3a14bfc93302

SHA256
3bf7ddb7e92e0122c9af323b1f44edf776dc9ca3e4d9549d63e28f764da20b21

SHA512
202f3325bd3524be89c14c5dadbf0fb9ef1b058c2708fb38382627f7bf327b012157fad0bf57a8ecb3d43726d7cdde0262daf93f53aa82f3aff9ae9f470aaea1

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
248KB

MD5
43359fec38798ac53c4864c53459ebab

SHA1
a6ecff005420407597635ac98b9c4c03d05e88a3

SHA256
e0bece9a38b9265a4024b089ae2682e7c412e697a28c3c4935062611508f30a3

SHA512
c4f17608ad4c1a2cde0df13784dd0542d5c152a19f0208cdcdf142c78b7f3e81bb6226f1675082bfc1f70811f437f496487781559d49c9734bcb1404ec0118b4

Download Submit
memory/476-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/476-31-0x0000000000230000-0x000000000026E000-memory.dmp

Filesize
248KB

Download
memory/476-37-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1140-18-0x0000000000290000-0x00000000002CE000-memory.dmp

Filesize
248KB

Download
memory/1140-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1140-23-0x0000000000290000-0x00000000002CE000-memory.dmp

Filesize
248KB

Download
memory/1140-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1140-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2312-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2312-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2960-38-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2960-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing