neconyd | cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c

General

Target

cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe
Size

72KB
MD5

87d057b93a2301e8de8bbb1a495e9b08
SHA1

bdf58c03ca185b5821f08509a30d496e88e0acf0
SHA256

cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c
SHA512

69d0106842aa4c88abfa8d4da87214ba09527446a493d431b2f690a5a1f6fb5671ffffa28cf25dd84dc206001b5d8cb9b9f0f79bf637e5f5065b18f83cc7bdb6
SSDEEP

1536:hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211v:RdseIOMEZEyFjEOFqTiQm5l/5211v

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2748	omsecor.exe
2796	omsecor.exe
780	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe
2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe
2748	omsecor.exe
2748	omsecor.exe
2796	omsecor.exe
2796	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2748	2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe	31
PID 2700 wrote to memory of 2748	2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe	31
PID 2700 wrote to memory of 2748	2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe	31
PID 2700 wrote to memory of 2748	2700	cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe	31
PID 2748 wrote to memory of 2796	2748	omsecor.exe	33
PID 2748 wrote to memory of 2796	2748	omsecor.exe	33
PID 2748 wrote to memory of 2796	2748	omsecor.exe	33
PID 2748 wrote to memory of 2796	2748	omsecor.exe	33
PID 2796 wrote to memory of 780	2796	omsecor.exe	34
PID 2796 wrote to memory of 780	2796	omsecor.exe	34
PID 2796 wrote to memory of 780	2796	omsecor.exe	34
PID 2796 wrote to memory of 780	2796	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe
"C:\Users\Admin\AppData\Local\Temp\cb1e09e30bb7273880cbcc9927e5d02b4f4fe6e25d0ed8dec47df6a78c70945c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
b65894502ecf2b5f3937259eb5301615

SHA1
0cc95adb325e604999f74394b2a865e787d9d554

SHA256
14e40595887be53d37d1356c2615b13bd991c8744b0f277799ce0072370d23bb

SHA512
479d2b14ab2d2081b444550b705af92f808ae721a840e346ae64116025ac84e3a5c7f85d97ee895469885d9bb5a9419868d5f3f6e692f78969d6a17bfe03116e

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
cd489a814304f7e3a7aca736273f0fce

SHA1
ad530fb24158b488c17543bbdd98419b86eb1e06

SHA256
0d975340093fdee0e02e7d9cd1e9cf5b2405585509f3e9c1f78d98dee8e762a2

SHA512
86a35c86cdebf26a486d963a871857cc8a3b9fa5e0d551adfe693941bb991250cfb151f5ec078a1b8ecb1853c783b267a80e319f2a82d8b4a81a68a405921282

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
b40da1443af438146b6a95ac78974c96

SHA1
03d8ff499b3f01e2d74ee0fa70b435fd1fe436d4

SHA256
2069d157d9698b0e3e8dd701ea5b2521942cfb4244f1ff6c4b2a8790f5fc7033

SHA512
8fa51caf32a53ab0dc675f177fb4275776c8b8775e9d180b4c7805198014dda4fe30f0767016b1211a9a9da741680b9db89066215d7fbb16271df4cc52880241

Download Submit

Analysis

Sharing