neconyd | a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60

General

Target

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Size

72KB
MD5

e544c386c4f1310d215d4bdf5497b1ad
SHA1

d2ad21ac86c9b60fa0ee6d96a2820d3692a3ee7b
SHA256

a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60
SHA512

5d49df0218e29afa78886ab460af24db9797168fc80f6a3050c4bd2bddb9998006ca108de8afe33cd324c7e84a7a3f9b269abeeb634f6db347fb76a228a2be74
SSDEEP

1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/52119:+dseIOMEZEyFjEOFqTiQm5l/52119

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2784	omsecor.exe
2396	omsecor.exe
2968	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
2784	omsecor.exe
2784	omsecor.exe
2396	omsecor.exe
2396	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2784	2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2080 wrote to memory of 2784	2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2080 wrote to memory of 2784	2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2080 wrote to memory of 2784	2080	a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe	30
PID 2784 wrote to memory of 2396	2784	omsecor.exe	32
PID 2784 wrote to memory of 2396	2784	omsecor.exe	32
PID 2784 wrote to memory of 2396	2784	omsecor.exe	32
PID 2784 wrote to memory of 2396	2784	omsecor.exe	32
PID 2396 wrote to memory of 2968	2396	omsecor.exe	33
PID 2396 wrote to memory of 2968	2396	omsecor.exe	33
PID 2396 wrote to memory of 2968	2396	omsecor.exe	33
PID 2396 wrote to memory of 2968	2396	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe
"C:\Users\Admin\AppData\Local\Temp\a58b79adbd560a380dce41d175c340c90dab04cf1534d4d5dbd3f3c5ce803d60.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
151cc6396cd1e9804e433749f3bb9e30

SHA1
0262179e7a91dd01329d2f03556d2cd027ad8f71

SHA256
f22b25b59855695f9c9d7145909343efa55701807613e73309cf2bac47733dc2

SHA512
ca6c5d0f4b99e01e91ef6b9c2c882f0f8446f0841d8c62d227e5da1978ef58582d5a632f22eb5f2514148090e0f7c70868eaa69ba52e92e67c7983f52dc5a71a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
282c401547ac991691d42e5b884bef4b

SHA1
dd7db43193462a6cd19df2b4ae7a41fe4b8381a8

SHA256
88aa594d341e79547b77d7aa2d5979b3bdcfb9c016f86e0788a97eec8e160327

SHA512
db1513fcaa394f31ead7d643e6593bc7b659aa37fb69b05fa3203e3ebc00c44059dc212b09c7d11c03c9d89abcadbd73d7368f05590370a928b61502bc6d8601

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
e47cfa0767471d645109d482491c241d

SHA1
935cb87b7ea37c9354559650700abd768bf9e1c8

SHA256
10cf90d943917ceb4b70e1178b61f3ce7381b51745687d942407641be5d205e8

SHA512
560abc3626ddfeb2fc01531775aefb50e1fe0e82faacf2cab9eda35515623fc1c0ce29f07ccb33c5753c4e512c4bb7e3f5a6e06a707d318b4b9cd5d31a1da8eb

Download Submit

Analysis

Sharing