neconyd | 9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903

General

Target

9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe
Size

61KB
MD5

0ae69dcd82d19b6198b367d47664d750
SHA1

2fdcf486e68cfe5f84bcc8ef8f1fc465606b59ec
SHA256

9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903
SHA512

21a751134ba8eaad85cb87800100a4ba0cc92b89a060efbd276f29d005c9d1ed229389b73cbb18970bb902f47d638fd7d58b5c77de4fe4a31197166a2dd82044
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZjl/5:kdseIOMEZEyFjEOFqTiQmxl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2096	omsecor.exe
1592	omsecor.exe
2044	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe
2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe
2096	omsecor.exe
2096	omsecor.exe
1592	omsecor.exe
1592	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2096	2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe	30
PID 2172 wrote to memory of 2096	2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe	30
PID 2172 wrote to memory of 2096	2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe	30
PID 2172 wrote to memory of 2096	2172	9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe	30
PID 2096 wrote to memory of 1592	2096	omsecor.exe	33
PID 2096 wrote to memory of 1592	2096	omsecor.exe	33
PID 2096 wrote to memory of 1592	2096	omsecor.exe	33
PID 2096 wrote to memory of 1592	2096	omsecor.exe	33
PID 1592 wrote to memory of 2044	1592	omsecor.exe	34
PID 1592 wrote to memory of 2044	1592	omsecor.exe	34
PID 1592 wrote to memory of 2044	1592	omsecor.exe	34
PID 1592 wrote to memory of 2044	1592	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe
"C:\Users\Admin\AppData\Local\Temp\9e4f8f1c77a6f54e1e546ff028d75e12a38218adb65789908660ba903724a903N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
e79d88550735b96a1e0d4491ab9c9715

SHA1
088cead7714ed496d754b592d80ebc46812ef038

SHA256
ab1ce3ce1fb24f8ecf9e3b3709f749c0113c912e7f6950829ba955e14de27a04

SHA512
fb660c37cbf061554075bc5d5ab25d0387bc8f49d5b7b796a8e8a3378087e6bb06eb12d98b2e1e0a4cc6e3d2c6dd437c117dff7d81f33e018751ad8c1c784820

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
cd48fe3ad3a85f7c74f04d8d2fa05fa8

SHA1
9b696c4f5e288eec9ab978a6759b7c71a75ffed2

SHA256
c9492cf7d9128c374d9946a113951a7c77b2e1c4a8dcca47f5540d184acda7a5

SHA512
01f01cb6ccadbaaf583fd0eb573fdbc4f0b7ad4ecc8ec195201dbb9697eee4cc24eb6fc4aa7043b5a0f64803eeee2238c2b3cf59d7610bd1dd740c249d40655a

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
1e38e96393fb7eaa5bea6c3581fef21c

SHA1
a4e910e676a0c6f91f4ce3f783a246ffa846b5d6

SHA256
f4744d0cacd11dc66dc970f9d0a12f04f5f758c6202ea9f1102a6d26361e1f40

SHA512
6c62896b2f54440075bc969c65db83f48c7c6e2564b76a1cd038820cc954b3e3a6b3916401c052e26b10e55307f5493fbf4dadeb1b3ac0baaaf7d51ee6479458

Download Submit

Analysis

Sharing