neconyd | 86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065

General

Target

86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe
Size

64KB
MD5

3bda97468b18ba7d2a0c116b281761a0
SHA1

aa1d379911bc389465892ed4df92875c707d3193
SHA256

86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065
SHA512

f5043927dadd14300a9a8fe412d076183bf0556fc95515afe5d3494d4ddeb7a5063fb60ec88367351a44ea5c1c7f6d75ea6ddd9f71c7d455c94ba327c1861d39
SSDEEP

768:oMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uAN:obIvYvZEyFKF6N4yS+AQmZcl/51

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2392	omsecor.exe
2352	omsecor.exe
1512	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe
2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe
2392	omsecor.exe
2392	omsecor.exe
2352	omsecor.exe
2352	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2392	2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe	31
PID 2724 wrote to memory of 2392	2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe	31
PID 2724 wrote to memory of 2392	2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe	31
PID 2724 wrote to memory of 2392	2724	86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe	31
PID 2392 wrote to memory of 2352	2392	omsecor.exe	34
PID 2392 wrote to memory of 2352	2392	omsecor.exe	34
PID 2392 wrote to memory of 2352	2392	omsecor.exe	34
PID 2392 wrote to memory of 2352	2392	omsecor.exe	34
PID 2352 wrote to memory of 1512	2352	omsecor.exe	35
PID 2352 wrote to memory of 1512	2352	omsecor.exe	35
PID 2352 wrote to memory of 1512	2352	omsecor.exe	35
PID 2352 wrote to memory of 1512	2352	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe
"C:\Users\Admin\AppData\Local\Temp\86696d68a800c1ae54248d11f1247a5e8a4dfba9924b3af7325272b6969b9065N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
7fd04814af596edada34cc1b85704c70

SHA1
810c7c7fecff47b0875438e8587766f556bfa474

SHA256
30c6a4e8c0ba520ce278dac88616cd91429853de783db9d24e4aedeb56e6254e

SHA512
7f88c3731563d5433c434028c19a23c6d1930d8986cdfd8afeccdd8c7027167c57ec8db110e08e1ec517e152453768a064362764e1dbb62d841eded39ab2b521

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
e8172aa27ac4ad31fef6abf816bad2e0

SHA1
1016f50a13bee21711e6627be238de9bd7956b89

SHA256
bbcc81bb6acf190a3f17ee0a8eb50e018f79b595e538f5cda94002a46a10ca76

SHA512
866cf62ae6fb928427a1f0df0bc8867f12803a424e5f318612428dd8036d926f300fbcd9217969a34e47d9f58df262ee630055d67ec0e22cfb4638dc866d3113

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
b9d7dab3a1daa6881afc003f19a12cd4

SHA1
74eb016345ee1dc7d557a7b27cc5e4ff66f74f02

SHA256
90d2ff17e826f5b81d1cdf69834ddcce03ef8a753704de1ef3372021be7db542

SHA512
9d62833108f951b0a25c6cd82bf4aedccf0d5dc9fc81746db440083f6bce0035d236377c7ba733c6a0bd84116b50c222606b3770f05ad32994757814bec28470

Download Submit

Analysis

Sharing