neconyd | fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67af

General

Target

fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe
Size

33KB
MD5

a410c367e098e79280df3a7a9064f9b0
SHA1

fbd14dc76e2b2e7ac73fc710676e598ef4fe8c4b
SHA256

fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67af
SHA512

19b713dea81238e9b0155fba001481d6c15406067f442f58724921d8613ffafc7d7f9a6cd862808fe9512f68ae91eb5aceb512176fbb91058527919f013cd3e4
SSDEEP

768:8fVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7Dd:8fVRztyHo8QNHTk0qE5fslvN/956qo

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2452	omsecor.exe
2076	omsecor.exe
2296	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe
2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe
2452	omsecor.exe
2452	omsecor.exe
2076	omsecor.exe
2076	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2452	2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe	31
PID 2244 wrote to memory of 2452	2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe	31
PID 2244 wrote to memory of 2452	2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe	31
PID 2244 wrote to memory of 2452	2244	fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe	31
PID 2452 wrote to memory of 2076	2452	omsecor.exe	34
PID 2452 wrote to memory of 2076	2452	omsecor.exe	34
PID 2452 wrote to memory of 2076	2452	omsecor.exe	34
PID 2452 wrote to memory of 2076	2452	omsecor.exe	34
PID 2076 wrote to memory of 2296	2076	omsecor.exe	35
PID 2076 wrote to memory of 2296	2076	omsecor.exe	35
PID 2076 wrote to memory of 2296	2076	omsecor.exe	35
PID 2076 wrote to memory of 2296	2076	omsecor.exe	35

C:\Users\Admin\AppData\Local\Temp\fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe
"C:\Users\Admin\AppData\Local\Temp\fb26c05dacca15ee6c900d931ea4d65c9642cecbead7f334340d550844ad67afN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
a9b18e8397005e8c91a39bdb9061ec10

SHA1
cbb1906f5047af8a912a018ce25c761030a93c12

SHA256
8a68fc290b8da505ad7b4b31f5b4c1e1bdb976b9589e80c1cdf4d769b2c05866

SHA512
7a2ab75b598fbae42273f4a7681c6a69997d9747043f77acad2e0deb0b00f5dd62f74625cfb9baebcd34afd385c3cb97987b1f93e4391f27f108a4ac023ef199

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
33KB

MD5
9c96f06e9d8f8226b7048832d61ba684

SHA1
3b76d23ce04cad1c8aaafcfe22e664f60e1423da

SHA256
f3500708669a840ad249ab90543fac8a7b15f5627c90aef1346f460458dd5fe3

SHA512
5f5a44076004a4633728b77ccd49798131dde70da7c72e54a3b6716ea8406f350140600f96ebee3faae5923e1089e49da3c3d5eeb73bdff13100cb3fce040ae3

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
eee79a996952ce4a6ca4449c91a6199b

SHA1
5dc9e58f2cdcbf0a30bb75534169d03e10e14d6b

SHA256
f09fa55832e853eb8f2281c4150b0d5a4da11ef6824c8e0055f87b446597b8ce

SHA512
be247508c0028d04dfb614d86238a3001a8d073661caf4a04e203d852c6ae91d5e3522a1de6a5a987fa411826246c5547cd7d9f642ac08a15be79c0d24b67951

Download Submit
memory/2076-39-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/2076-45-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2244-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2244-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2244-4-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/2296-48-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-33-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2452-27-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing