neconyd | a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb

General

Target

a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe
Size

89KB
MD5

d4982f12d75480793c716cb83b68012a
SHA1

aff01301f46f20d0e8bc54ee554d26c6cb21f129
SHA256

a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb
SHA512

8849be50401eaf11211f5cf9c0ca8bd313256db72cf6a7fac3119d656093ba86f7376525f5f08813c33fa0df6a6f344760c71f757ca80f915eadee3791e66422
SSDEEP

768:4MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAP:4bIvYvZEyFKF6N4yS+AQmZTl/5H

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2808	omsecor.exe
1928	omsecor.exe
712	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe
2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe
2808	omsecor.exe
2808	omsecor.exe
1928	omsecor.exe
1928	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2808	2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe	31
PID 2744 wrote to memory of 2808	2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe	31
PID 2744 wrote to memory of 2808	2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe	31
PID 2744 wrote to memory of 2808	2744	a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe	31
PID 2808 wrote to memory of 1928	2808	omsecor.exe	34
PID 2808 wrote to memory of 1928	2808	omsecor.exe	34
PID 2808 wrote to memory of 1928	2808	omsecor.exe	34
PID 2808 wrote to memory of 1928	2808	omsecor.exe	34
PID 1928 wrote to memory of 712	1928	omsecor.exe	35
PID 1928 wrote to memory of 712	1928	omsecor.exe	35
PID 1928 wrote to memory of 712	1928	omsecor.exe	35
PID 1928 wrote to memory of 712	1928	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe
"C:\Users\Admin\AppData\Local\Temp\a314a6b8b2b9441fdcb3ec7905ca7b3b3d877bc485870e023a580dae7569f1eb.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
44decfb986f53671f572de1ca9beccee

SHA1
3a796d9d7aa6e58b24d3e8b40e0fa1f3b1d48677

SHA256
3df5f0cd4ee1155f59525f97ed0bc549b371cd88e8d3f55e34b2a90256311830

SHA512
cc3c7fcd0c8f9c4d9ed8e265131b33525258943b2f6c33a386e2c977efa2d2ef42b55109fe1af79583a1b6e4f29107ed8e2de77180800facd2fb11967485b1e0

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
fe033a34049c5d0756d3328fac603573

SHA1
6a5a8c10c2afd4c3948d44bee1144a049890eebf

SHA256
e74fe769d5a5dbb27607b96c20e378fa45cdb1fb761d8410f58ec4e3283cea7f

SHA512
d1e8aa215b1ce60aeb2838c51c745eacd8831b9e7c87962b5b33b6473d36fb037ee8c6ad4a12058d99a4a419269b15f7b472867d34454b8119d2e6b825c3ff6d

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
db8f9d8fc1b0d2c12d4f153aeaf336e6

SHA1
d7418e3fe08749c5ba36ca86f7da6f18e1e0e5e1

SHA256
9e8989859f7b01ce08a37da2911ac49ff61ba6f7a163af142fa19ff6f198369e

SHA512
c79af64aec8086698e662e823d0c867dd046ee05d8f48a7d2765347a8f3b267e85d5d32ec94ba9c7873569a46431e7bf43dd2a2bce44932b7c61d93c71054e42

Download Submit

Analysis

Sharing