neconyd | a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60

General

Target

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Size

72KB
MD5

e544c386c4f1310d215d4bdf5497b1ad
SHA1

d2ad21ac86c9b60fa0ee6d96a2820d3692a3ee7b
SHA256

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60
SHA512

5d49df0218e29afa78886ab460af24db9797168fc80f6a3050c4bd2bddb9998006ca108de8afe33cd324c7e84a7a3f9b269abeeb634f6db347fb76a228a2be74
SSDEEP

1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/52119:+dseIOMEZEyFjEOFqTiQm5l/52119

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
1100	omsecor.exe
1168	omsecor.exe
3000	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
1100	omsecor.exe
1100	omsecor.exe
1168	omsecor.exe
1168	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1100	2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2004 wrote to memory of 1100	2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2004 wrote to memory of 1100	2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2004 wrote to memory of 1100	2004	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 1100 wrote to memory of 1168	1100	omsecor.exe	33
PID 1100 wrote to memory of 1168	1100	omsecor.exe	33
PID 1100 wrote to memory of 1168	1100	omsecor.exe	33
PID 1100 wrote to memory of 1168	1100	omsecor.exe	33
PID 1168 wrote to memory of 3000	1168	omsecor.exe	34
PID 1168 wrote to memory of 3000	1168	omsecor.exe	34
PID 1168 wrote to memory of 3000	1168	omsecor.exe	34
PID 1168 wrote to memory of 3000	1168	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
"C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
1f5c2485a8019d1c4bbaba4b722e10bf

SHA1
771836a283651e2e3170486682f6d42e9a73acc9

SHA256
95a068bc1150d7255f332432812445004be89f90113ba6dad4a50bf594417863

SHA512
da8b11a9f1e964bc5cef28d6c83f033fc3ee51abe8e94a7b37ae73ad2d532b9d2593ed0f652f32a43dc52b9d06b860c7c19941eb7f366763bc561ef03f4f2172

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
151cc6396cd1e9804e433749f3bb9e30

SHA1
0262179e7a91dd01329d2f03556d2cd027ad8f71

SHA256
f22b25b59855695f9c9d7145909343efa55701807613e73309cf2bac47733dc2

SHA512
ca6c5d0f4b99e01e91ef6b9c2c882f0f8446f0841d8c62d227e5da1978ef58582d5a632f22eb5f2514148090e0f7c70868eaa69ba52e92e67c7983f52dc5a71a

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
c3e55ae7c395a5c87fb5c630ab1f7b36

SHA1
eb19145c82dff1a4ceacdbc0f6a2ce39b8421572

SHA256
4c07ffcc0d58881ed7ca1d194382141cb42346928f050db3b482f0ea7330e668

SHA512
359edd19e315e0bc2110a4f51d0efe7b907f9c09f8c8332818fe9caa6f06b0532576d1a04f926b1346424677163ed7f9384d1a4241fe05bf6177d5103c4f0347

Download Submit

Analysis

Sharing