neconyd | 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76b

General

Target

065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
Size

76KB
MD5

81fcbbf335f57c98713f9ed7cbde61c0
SHA1

fd441e63eba1e52c49fe0a4c746cb68177af9979
SHA256

065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76b
SHA512

c9476c644af262c4c9339b82d913922e867e91994512523624cf7675db5be265ce495c7b4493e5d0ae4ce877587371acb6d2197481fe92346f65c1b197f38760
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11f:kdseIOMEZEyFjEOFqaiQm5l/5w11f

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2772	omsecor.exe
2624	omsecor.exe
1932	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
2772	omsecor.exe
2772	omsecor.exe
2624	omsecor.exe
2624	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2772	2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe	30
PID 2756 wrote to memory of 2772	2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe	30
PID 2756 wrote to memory of 2772	2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe	30
PID 2756 wrote to memory of 2772	2756	065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe	30
PID 2772 wrote to memory of 2624	2772	omsecor.exe	33
PID 2772 wrote to memory of 2624	2772	omsecor.exe	33
PID 2772 wrote to memory of 2624	2772	omsecor.exe	33
PID 2772 wrote to memory of 2624	2772	omsecor.exe	33
PID 2624 wrote to memory of 1932	2624	omsecor.exe	34
PID 2624 wrote to memory of 1932	2624	omsecor.exe	34
PID 2624 wrote to memory of 1932	2624	omsecor.exe	34
PID 2624 wrote to memory of 1932	2624	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
"C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
ae1487c3d2b7d2a7485d9bb6261708a5

SHA1
26e7473bb57b5f67bef435eb159bc8af269e3694

SHA256
159324e1ae77e4051db840c317bd6ed04751082bb66d372f077563ec47919049

SHA512
5d17ef745ad46bdd00803cda54690124936ab64e29480a2cf9961ac536d5a3bdb3d654c3012d91fde355e32bbae1a2d4582c3cc9a53805cf93a4b67d4c9c393e

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
f64ea2fa9bb76fd9e3ed2ff36e05b04a

SHA1
3be7d2a55f38d6775c907fcea19caf6d3582a640

SHA256
acf5f3357654db076d1dd24e3bef84d9f7b4c16a07f0a742ff16c35e6bda865e

SHA512
43d16429e8972fec08404737316ffee1e792120d586d5e6362986d9f10b7192d1763c1e13b6affabd66aac73cd8a99b0d13f9969a19dc5f15fe96eb39dacd6ce

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
cf966f5356fb930c5fc84a59bb8101b9

SHA1
a7d40db4f8bc2e8f6a07e763f1bf177be3e3d6c7

SHA256
44b7d7b927dee31cf6f9859beeff124755661be5d4c3ad6008aba6fd37a60742

SHA512
e64cd9cff8f82e9e7b5f1b3a5261a74d6100f6bc633a6656c200b23ff26a1ddfeffc3cb74444d716a52973077e35eb46e1c33c0ad4adf3129c1866c42ff358c8

Download Submit
memory/1932-35-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2624-27-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2756-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2756-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2772-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2772-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2772-17-0x00000000005A0000-0x00000000005CA000-memory.dmp

Filesize
168KB

Download
memory/2772-24-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing