neconyd | 1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7

General

Target

1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe
Size

61KB
MD5

09534757f4b64fd024a45cc653752a8e
SHA1

56d4789246d617c29d058c8a2cff3ddc32e7394c
SHA256

1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7
SHA512

7deee7ad0d96210149ee8fcdaeacc10403dcd735518bddc58bb5499eea4e47f2514d3ce1b07b61a65fb0cb8165760318bd1494c729434e6a5267ac67652892be
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZjl/5C:kdseIOMEZEyFjEOFqTiQmxl/5C

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3040	omsecor.exe
2304	omsecor.exe
2068	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe
944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe
3040	omsecor.exe
3040	omsecor.exe
2304	omsecor.exe
2304	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3040	944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe	31
PID 944 wrote to memory of 3040	944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe	31
PID 944 wrote to memory of 3040	944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe	31
PID 944 wrote to memory of 3040	944	1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe	31
PID 3040 wrote to memory of 2304	3040	omsecor.exe	34
PID 3040 wrote to memory of 2304	3040	omsecor.exe	34
PID 3040 wrote to memory of 2304	3040	omsecor.exe	34
PID 3040 wrote to memory of 2304	3040	omsecor.exe	34
PID 2304 wrote to memory of 2068	2304	omsecor.exe	35
PID 2304 wrote to memory of 2068	2304	omsecor.exe	35
PID 2304 wrote to memory of 2068	2304	omsecor.exe	35
PID 2304 wrote to memory of 2068	2304	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe
"C:\Users\Admin\AppData\Local\Temp\1d160ca7730d6deacfdd01f2e19529ff93500b90374ba59d8faa5df960ae2da7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
26db7c016a583f578811e13cedcfdcbf

SHA1
aa7bb664a2e55869765012aa3ec2b7256ec1c850

SHA256
838f89384c7a5227e11a466791d2f391aec92c40aa26792f6cd28e8609c61551

SHA512
500921f79da5706064559cd9fd1cfd9f0903df328d53e4e54def91608b54d82c71478765937d6d7a1b9e2516adb063423493b7dbfdf7a7fc6b46767cf0485a8f

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
d91934793f8b3e672c77081da11bee1b

SHA1
469c4133a9eb3b773df4b89868affdd1778f314c

SHA256
2631ccc6a1a3f594701db62b95f819c3441d4588a7ecf7ab0d43d7ce22a003c4

SHA512
d15a5d4a222834ba8e5e9a9794767b4cf8bc789a49912417ad8878e634c2a9ffaee2748352a4bab797900d9419ed5d870be16160339802abf970370aa6b00cf9

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
59c332e7afbb63e821842236a9a2dd9e

SHA1
917cbc56f895ffd55738dfe95193fc2645b60533

SHA256
b811468473b8607eca9ab072909b3dbdebff65dc00db774b0da1586d0958f8e2

SHA512
6b7b5db9fc966ad8bc65d0f21272097b7e89a7503c4330988c45dad27d1044b0611e2b5af83e6604b2cc4f131a5571a2db64c890809ffd05bd6049abe552f5d2

Download Submit

Analysis

Sharing