neconyd | d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6

General

Target

d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
Size

61KB
MD5

06e5bf97166620194efbcad564c87bda
SHA1

7933f8333bb7c6e0b7c4a72ec3202f89b76cf594
SHA256

d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6
SHA512

46234f48c7967baa43536c4eec4ced38db191dc4346526d963b63895fdefa6a124c0a9e5f16ba43c4aa0638e08b6cd5106f4dc007a32f8ece24e5118f76533b3
SSDEEP

1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ1l/5:VdseIOMEZEyFjEOFqTiQmXl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2212	omsecor.exe
3052	omsecor.exe
1836	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
2212	omsecor.exe
2212	omsecor.exe
3052	omsecor.exe
3052	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2212	2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	31
PID 2848 wrote to memory of 2212	2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	31
PID 2848 wrote to memory of 2212	2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	31
PID 2848 wrote to memory of 2212	2848	d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe	31
PID 2212 wrote to memory of 3052	2212	omsecor.exe	34
PID 2212 wrote to memory of 3052	2212	omsecor.exe	34
PID 2212 wrote to memory of 3052	2212	omsecor.exe	34
PID 2212 wrote to memory of 3052	2212	omsecor.exe	34
PID 3052 wrote to memory of 1836	3052	omsecor.exe	35
PID 3052 wrote to memory of 1836	3052	omsecor.exe	35
PID 3052 wrote to memory of 1836	3052	omsecor.exe	35
PID 3052 wrote to memory of 1836	3052	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe
"C:\Users\Admin\AppData\Local\Temp\d2347b0e067d43ada02a6fde570233354480245ca98b26eccd5b3c8abbb1c2d6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
271ee909fd4bb43fd96e13aa32e2c431

SHA1
da61cc51e5b445e46a5dd0ea8ec2998d673855b4

SHA256
a83900cdb3bc50f1ab0d48ef77b3a3525b8156a3e864727c254a926422e07f11

SHA512
eb3aa17b46c293d066346b12c1f6dfe25e5f7b6d002dd43bbd4a504d417f47b049cf78521cf94b98bfbb2e04e326e8377f6eb42d4313ecac79036f758d4c8b6c

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
e61da40fcd0b16e1ef5ed6e3d7fe7407

SHA1
68c3c6f30c490c7f08617cfc160cd403c737d9ad

SHA256
d1aa391442611112fe6627abddb280ec27ad2ba2b7c6a263f6ab6da4fc50b20e

SHA512
a6b21355f2c6feb9758cd0b5a1f596a8709765925a79d413a4757759b983862569c613a0e9cdd4306255d7ab43557e6428c502808f9078aab6e2cd26955dd96a

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
da6acb912b80e5cb9d214a3988287334

SHA1
de8b968c81656352df0a77f2bd6bda404182fe08

SHA256
8884dadeba40edf6152681a326f8e36a3e52719ce0d98cd1788cf13ef8a6d87a

SHA512
53eec2d29de18401f83c71e17ae2e9950000df1f65e285e4d56195150d6630d949c8d907d122723db71ad7d1256e9aea756938794afe5c3243cb4b6d0194aba6

Download Submit

Analysis

Sharing