neconyd | 5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02

General

Target

5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
Size

76KB
MD5

e625719f383b6b647d52a79ca97e1340
SHA1

c880a72b4edb2318640e08bc3c5d94ce2279280f
SHA256

5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02
SHA512

f4e9a93ea055a58973e8adab385e2a01565206bfb657c4dcc36aff8341da27354df94a4bc95f257c988be0bd5cdd2ebf9bd41dc5d4baa92f77a9a5b1f97ecc78
SSDEEP

1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11b:XdseIOMEZEyFjEOFqaiQm5l/5w11b

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2856	omsecor.exe
2728	omsecor.exe
2396	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
2856	omsecor.exe
2856	omsecor.exe
2728	omsecor.exe
2728	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2856	2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	30
PID 2796 wrote to memory of 2856	2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	30
PID 2796 wrote to memory of 2856	2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	30
PID 2796 wrote to memory of 2856	2796	5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe	30
PID 2856 wrote to memory of 2728	2856	omsecor.exe	33
PID 2856 wrote to memory of 2728	2856	omsecor.exe	33
PID 2856 wrote to memory of 2728	2856	omsecor.exe	33
PID 2856 wrote to memory of 2728	2856	omsecor.exe	33
PID 2728 wrote to memory of 2396	2728	omsecor.exe	34
PID 2728 wrote to memory of 2396	2728	omsecor.exe	34
PID 2728 wrote to memory of 2396	2728	omsecor.exe	34
PID 2728 wrote to memory of 2396	2728	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe
"C:\Users\Admin\AppData\Local\Temp\5c726ef1537032b8e886b5481a80fab21f41f9b610d82e561853c85409b90e02.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
7ee49d0d86e97854e51f91a421849168

SHA1
75b50ef899f91312cf359ec52ad3ba66a991019c

SHA256
0f2741b54aad10152414c3fbd48175dfd77bedf269f6ced5c104f75b431ebc94

SHA512
833c77342f6aa5b1d0bfdd2b9d7b2ab52c227c70fe8602081893a79aef61e4e6dfa36e10f8de3f3660cdf5da102df635357d21e8c2211a75f03ab9140472a6a1

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
69424c5c06c21e81bc343c4a15fed719

SHA1
2545aeb62324271a46fec7b43aae031ad1adf97d

SHA256
f2fc2eec15bf17b1a45b8c019f6541273a67ff3950ed86115b1eeb64e94cc47f

SHA512
e24a49f8f1ccf522d97a4bf5dad923d1bb715080badb6181c536d3682945bfee6b108d8bf73a412e9b7766a9c27be1f7ffa3cd85fe3f25d86000b3a8e2123ed4

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
51391bdcc6d571e55d6d653687d61d0e

SHA1
f76d2f1d7ac5ab048da8927174a84c373cc144e7

SHA256
414719e5b4912f07f95028af055450380d49b47962befddf75ccf12e207c52ed

SHA512
c9900e00960638e3d085e4886ded197d02c93b002d109c47f1f3ec8d1259f8472bd66e73e753797e46ca4c81dba782dc81a557d29e1d69cf294dcaea7ca3e46a

Download Submit
memory/2396-39-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2728-36-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2728-31-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/2728-26-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2796-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2796-10-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/2796-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2796-4-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/2856-25-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2856-18-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/2856-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing