neconyd | e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557

General

Target

e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe
Size

72KB
MD5

8a86f6907e31ff1e142f7ad6150c7bb0
SHA1

acb56477351906d3cd1e19c34ca5dfa5af6edb16
SHA256

e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557
SHA512

70c90ef4a7b025473e4f9a31f6efa770b04679439bcf13a17dec1e3d7080e933ac7fdb11f9831300021f5a48d4db67bb89bff383b229cb2ba7a87d6f4ae363c5
SSDEEP

1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211t:7dseIOMEZEyFjEOFqTiQm5l/5211t

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2692	omsecor.exe
2220	omsecor.exe
2912	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe
2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe
2692	omsecor.exe
2692	omsecor.exe
2220	omsecor.exe
2220	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2692	2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe	30
PID 2236 wrote to memory of 2692	2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe	30
PID 2236 wrote to memory of 2692	2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe	30
PID 2236 wrote to memory of 2692	2236	e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe	30
PID 2692 wrote to memory of 2220	2692	omsecor.exe	32
PID 2692 wrote to memory of 2220	2692	omsecor.exe	32
PID 2692 wrote to memory of 2220	2692	omsecor.exe	32
PID 2692 wrote to memory of 2220	2692	omsecor.exe	32
PID 2220 wrote to memory of 2912	2220	omsecor.exe	33
PID 2220 wrote to memory of 2912	2220	omsecor.exe	33
PID 2220 wrote to memory of 2912	2220	omsecor.exe	33
PID 2220 wrote to memory of 2912	2220	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe
"C:\Users\Admin\AppData\Local\Temp\e8eaf2fb655d8059030acc99c5d283d97a8e2565404c4af6ded877135328a557N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
9198dbefcf9e5b77e4181c9ce5de145e

SHA1
98681b3812b3f32a70e199570ee0a43a8f5300e7

SHA256
5326cedddaa319c4fd41b27827494006292a9187483c39b316787343ef8e7086

SHA512
9ae2b2cd8a1f64441a0b354e216d4f8459706c003a2d628150ecddae2b4244248333041e42cfd72055dd397d36bfb55b4505f604d9bfaf74482348a52ac2b19c

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
22aafd91d39fcb7657c5eac1a6fde4c5

SHA1
c7b6099bf5dcb122cb9e2d607a2b5fcb736cebe1

SHA256
5dd3ee8a3505e8a5c6ae32d4b40e1f8a602681831aa053aab25614f960c37547

SHA512
17dae1d0870a50962227b60d29fb37d05190906ba0dd8b5b383e19605eb11e28c5fce30e01b050585e1aa3e66037461f6b2c2f0ec4ae83bfffd726d9ef8efe21

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
bd24519d1387d76c40f9cf2425c587f8

SHA1
3345b90f18d014177c3d66c925c62f8c55c6f63a

SHA256
daf4309c1e422de3078b43ce214d9939ba9008cf94339916210f03616a828399

SHA512
c413d60969a451423da4cfbdb7454ea56f5dc758c3b9dbc67c418d4819e38fe13af058b1433ecf76281b91beac14a22b8d30f6054310b3a7128036548b06aa81

Download Submit

Analysis

Sharing