neconyd | 3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6

General

Target

3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe
Size

72KB
MD5

b1b70c779ade055d67a6972060d2db81
SHA1

a5ba3226d03d0388390a3b7bfd6eb20e07359552
SHA256

3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6
SHA512

b0c817916cddb3c88f3f9cfaa66ce97720270134ae82dd1ccfc3008cd65ea210cf5e9dba43f6e957285362c5d407cecb67c494f5e659ae361cebca464ad76f78
SSDEEP

768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAWG:NbIvYvZEyFKF6N4yS+AQmZTl/5OG

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2692	omsecor.exe
2000	omsecor.exe
2784	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe
2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe
2692	omsecor.exe
2692	omsecor.exe
2000	omsecor.exe
2000	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2692	2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe	30
PID 2228 wrote to memory of 2692	2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe	30
PID 2228 wrote to memory of 2692	2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe	30
PID 2228 wrote to memory of 2692	2228	3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe	30
PID 2692 wrote to memory of 2000	2692	omsecor.exe	33
PID 2692 wrote to memory of 2000	2692	omsecor.exe	33
PID 2692 wrote to memory of 2000	2692	omsecor.exe	33
PID 2692 wrote to memory of 2000	2692	omsecor.exe	33
PID 2000 wrote to memory of 2784	2000	omsecor.exe	34
PID 2000 wrote to memory of 2784	2000	omsecor.exe	34
PID 2000 wrote to memory of 2784	2000	omsecor.exe	34
PID 2000 wrote to memory of 2784	2000	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe
"C:\Users\Admin\AppData\Local\Temp\3a078c9f2ad655866c1ebeb39522e76ae3037f684839f46b62895555621544c6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
28823761fcd6c1cd49573230f183e297

SHA1
b23de24443a87583e20ae242c97544d3bb54046b

SHA256
8f61a9706d2ad63fe1e15f8fea3ff3204ec3192293539bd273cf6e3e9014f281

SHA512
47da7c2dad383a7516748221bcd8c356a771308ec990e794abc5c1f7851487254e6a10466c8ea7fc04ac3bc80727bd85784989f5f05af2f4f25c9504d95b3c13

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
f0bcf7c66ec3c829a0bf7128c1bed0ab

SHA1
83233abe5586d0972f453b3dc27f2ed37b9c187f

SHA256
70a10a4a9683543a3dd4b32cd438d26238a9484944e494cd4c5adc1356a2b9d2

SHA512
290a6bb93c58543bdad267aa86ddf65e3ab840fcc420127a2b048761acd1086aa5eb523d7c1725c6dfa8538e44e3f78e408c04b92d7814dbb405366058579854

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
752d2d5d46f6ac87fc12a34f427f84ce

SHA1
198212cb3fb9d4ac13862c67dd399b5ea5aee94f

SHA256
8462b1b7626eefa9ca131e1f37efac287a61e1a722a0ce71855984b5c78a1e84

SHA512
9a1ea93aab8e3398ed2907c4043f7b320af68747fca3ef0109d0a86927760708db4e34364db50a59980af751c32b0d6a828e86c41b6f97bbcd94235673dfb1c1

Download Submit

Analysis

Sharing