neconyd | a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117

General

Target

a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
Size

92KB
MD5

4f255b55b9ec24e331ad774099e59630
SHA1

1eb3763c3f164c073bb320646f5b6a59616b6fec
SHA256

a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117
SHA512

8ece9d7cf3c022883f9cf8c94b26cd00bda9a0065aea6539b0a9e9c25470f5de8d4f069f9fd57c142d1b29c762345c221f2c25d3186dbd8890e15c8e968d59d4
SSDEEP

1536:Kd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5d:KdseIOyEZEyFjEOFqTiQm5l/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2028	omsecor.exe
2216	omsecor.exe
2952	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
2028	omsecor.exe
2028	omsecor.exe
2216	omsecor.exe
2216	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2028	2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	29
PID 2540 wrote to memory of 2028	2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	29
PID 2540 wrote to memory of 2028	2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	29
PID 2540 wrote to memory of 2028	2540	a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe	29
PID 2028 wrote to memory of 2216	2028	omsecor.exe	31
PID 2028 wrote to memory of 2216	2028	omsecor.exe	31
PID 2028 wrote to memory of 2216	2028	omsecor.exe	31
PID 2028 wrote to memory of 2216	2028	omsecor.exe	31
PID 2216 wrote to memory of 2952	2216	omsecor.exe	32
PID 2216 wrote to memory of 2952	2216	omsecor.exe	32
PID 2216 wrote to memory of 2952	2216	omsecor.exe	32
PID 2216 wrote to memory of 2952	2216	omsecor.exe	32

C:\Users\Admin\AppData\Local\Temp\a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe
"C:\Users\Admin\AppData\Local\Temp\a195c815065afa1f6290b8447ca799a17f719bf7bd451fcb64a8c4e266eeb117N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
7fe023bd6a18199fb4e09b13388c4bec

SHA1
26119cfe8818bb197f398025399116ca00ce2ea0

SHA256
d1f5c66713ca248412036eeb18c1deda030d78772975bcfd582f33fd4b0b7c1a

SHA512
fa092adad5a9ac004dbd5c8749622e4d7d237352b9d46650588731ecdc53d179f45e02fd2285718f1eae5a173d7f22dc2379ceda8177d86422bae34e142c8bfa

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
f7dd1995471efe881b65429b76bd0132

SHA1
d94bf9358d00d69af934de854e2aab7b3a927bb2

SHA256
1c1a1cc29ff44fcd834fe9179a9ff365e3e14ade877f97a93d15b3b765afd566

SHA512
a6e75c327cd32f074dc3e68840ed0ebeac8adf8a63fb6b54e0963f095700f81520809511ddf93bd07a04790927ed611a8d4f4ed72601b20ab3cf839af62b09f0

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
92KB

MD5
7181e322fa9074a3f8dacd161b241b19

SHA1
48ec426910473cc5f7b8895b1ae66df1536b3fd6

SHA256
1356b665cd8709fbef82dac649704fdaccefb162e973e320499111973860d6c2

SHA512
5727d18eed3bc54322b813bf1ceca1b999a71c78f1e32947dc3fdda3f246e40cf576d989a3684ac1e3aa85419bba74c99521901d36cac7a4dce60387c09e1822

Download Submit
memory/2028-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2028-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2028-16-0x0000000000350000-0x000000000037B000-memory.dmp

Filesize
172KB

Download
memory/2028-22-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2216-28-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/2216-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2540-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2952-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing