neconyd | 71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040

General

Target

71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe
Size

64KB
MD5

c905133d04e42e3abb677b0d3b4b44d0
SHA1

598ef8b9725a06652b38ff5ba174a1ffd019128e
SHA256

71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040
SHA512

d5a65b42fe4e922cb8e60f0e5e419d800eb733abbb5d26694debfe9cd4d2974c64837cffa081211c7583aabbda4ee1f79c4eab40291dc5e86cb2f3e442cbaeef
SSDEEP

768:sMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uAH:sbIvYvZEyFKF6N4yS+AQmZcl/5f

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2400	omsecor.exe
572	omsecor.exe
2856	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe
1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe
2400	omsecor.exe
2400	omsecor.exe
572	omsecor.exe
572	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2400	1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe	28
PID 1120 wrote to memory of 2400	1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe	28
PID 1120 wrote to memory of 2400	1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe	28
PID 1120 wrote to memory of 2400	1120	71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe	28
PID 2400 wrote to memory of 572	2400	omsecor.exe	32
PID 2400 wrote to memory of 572	2400	omsecor.exe	32
PID 2400 wrote to memory of 572	2400	omsecor.exe	32
PID 2400 wrote to memory of 572	2400	omsecor.exe	32
PID 572 wrote to memory of 2856	572	omsecor.exe	33
PID 572 wrote to memory of 2856	572	omsecor.exe	33
PID 572 wrote to memory of 2856	572	omsecor.exe	33
PID 572 wrote to memory of 2856	572	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe
"C:\Users\Admin\AppData\Local\Temp\71560bb5e31c7950958baeeca6ec5a2c0bc35427a534793230feff0bb362d040N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
d561583e1927aea6c72ca11a5c80c8be

SHA1
55dc2f33d5234ada72de7cf6c70d3487eaf576f0

SHA256
a55adea243226763110365e46acc7ac13b86d0bbb1df630a3543076ae143b152

SHA512
0381c894591915031d6ef3fc4360704f5d96ce7f33cdea96f253f4c389fde23a491343337e4f0dcb811e73e40315a2c988c588d4cb8327a691190ae61a013d7a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
a6fe1501bb745d438a2cfe14d6c35968

SHA1
a4b9b5d6a937643b344ec6b092ca9560d0bdcd33

SHA256
1f641a301801cdb3ee827a0391fe7a4c6bfa079b7f5bf5271c50a1b56eba2160

SHA512
4d28be76c956e9c092c0c31a786aef84068865399e96cdaaa6331d2fb428ebe98740e0a43049c1a81667c6b542ceef084a99d24877e24b86ba0306b2826a4d07

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
7a2f67ddc3b7a7f333ed1eba68456e4b

SHA1
111cb32b48f09263c6d5fe9344176dfddaea5cec

SHA256
8a0494b1cfd74e58a6fc61545a293d2d5629d39bc0656aced8cd7ed8b9f16204

SHA512
e658a7ae02920d5af4fd9654015e2c8975366dfbf315e6ba94c9b510a76acbae1fad4f2abd2a51ec0fcd832294de3da3e75410752f1d00896f3ae1740282d5a9

Download Submit

Analysis

Sharing