neconyd | 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f

General

Target

17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
Size

61KB
MD5

a74cb5983f2c35758dbfb8918f1c1de3
SHA1

8d44cd64264c145feeb9ce87f9a77e4c3edca65e
SHA256

17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f
SHA512

4cc0792d2bb0ba057a0812262adabdc076a9bca756b25ee8b8a3fdda9d2e4e6b888c3202dac93b1397d75a61dd674125014a59a8e853c942c6bd308e90530bf3
SSDEEP

1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZll/5:ydseIOMEZEyFjEOFqTiQmPl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2360	omsecor.exe
2644	omsecor.exe
2324	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
2360	omsecor.exe
2360	omsecor.exe
2644	omsecor.exe
2644	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2360	2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	31
PID 2328 wrote to memory of 2360	2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	31
PID 2328 wrote to memory of 2360	2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	31
PID 2328 wrote to memory of 2360	2328	17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe	31
PID 2360 wrote to memory of 2644	2360	omsecor.exe	34
PID 2360 wrote to memory of 2644	2360	omsecor.exe	34
PID 2360 wrote to memory of 2644	2360	omsecor.exe	34
PID 2360 wrote to memory of 2644	2360	omsecor.exe	34
PID 2644 wrote to memory of 2324	2644	omsecor.exe	35
PID 2644 wrote to memory of 2324	2644	omsecor.exe	35
PID 2644 wrote to memory of 2324	2644	omsecor.exe	35
PID 2644 wrote to memory of 2324	2644	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
"C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
cf6dad5049ec79983370aba4f59b1e72

SHA1
ab04a7131ef0f89b583e47f24ef70073033fc094

SHA256
4c7b31fc9913222b3ef875a9403de1cb38014be8f40486c6799dbf0d5034f9f6

SHA512
9cfc7fc72483dc31f9f7d4db71f6e21707a2652f252d9a00cb9d1e85548d0ae265f13f93f9bfd24f4cb4e46ee49b924c604cd01434aa01ad4e694ab67dfb7b72

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
6cf2457d1ed3508b97412f694ef399f7

SHA1
2bef013201a89766480d54e714c1bde6a61a8cca

SHA256
c2a8559aaee120eb7b3002860244c1c4634cbb9ed6a40d365df35dfc1dcafa49

SHA512
5d90214573b34bfc914aba2c34515fcd03a585fc02f58e82c4214906e3f2266b15a7fcacc2f9cbca5f97f3842df883b2064c53064b74ffc65ae6613dd8079dbe

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
a6a02e34883be7304039231bba93d0a3

SHA1
82e5d4b5e5f1bf57363f9af0d491569e20fd8c77

SHA256
1cb75a14a33757526b50a9d29c33eb33b3e12e06326a21a6d77876e0f069eb57

SHA512
392e8010d54a6396cb372cad63f6dfd7d1fc9dfb86262352954f6778b1928bc70ab1d55f9e4f2fe1cf5f13111fc3af7ba5ee7bf7180a9a6cd09835e3877910f7

Download Submit

Analysis

Sharing