neconyd | 4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5eda

General

Target

4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe
Size

61KB
MD5

7838514e3189111da1d47ed6422e0ef0
SHA1

af409beeb187e04417b161e7e187feb94fd480ac
SHA256

4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5eda
SHA512

fe553727ed52dfcfede0d3d7125cc5ffed473a1832d67fb34768b99ad977dd95a256292b178c7dc2d82411368a701c32e9658fefa31c32230d78ed2a1c922884
SSDEEP

1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZxl/5n:7dseIOMEZEyFjEOFqTiQmTl/5n

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2368	omsecor.exe
3056	omsecor.exe
1436	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe
1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe
2368	omsecor.exe
2368	omsecor.exe
3056	omsecor.exe
3056	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2368	1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe	30
PID 1740 wrote to memory of 2368	1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe	30
PID 1740 wrote to memory of 2368	1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe	30
PID 1740 wrote to memory of 2368	1740	4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe	30
PID 2368 wrote to memory of 3056	2368	omsecor.exe	33
PID 2368 wrote to memory of 3056	2368	omsecor.exe	33
PID 2368 wrote to memory of 3056	2368	omsecor.exe	33
PID 2368 wrote to memory of 3056	2368	omsecor.exe	33
PID 3056 wrote to memory of 1436	3056	omsecor.exe	34
PID 3056 wrote to memory of 1436	3056	omsecor.exe	34
PID 3056 wrote to memory of 1436	3056	omsecor.exe	34
PID 3056 wrote to memory of 1436	3056	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe
"C:\Users\Admin\AppData\Local\Temp\4ba8cf6ca6acbffee2c6d8a3293a57e8053f907adab853aac86af2295d2a5edaN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
ed5942db0a4e9dc8d29337e35f87b935

SHA1
932be1b833e47181be1a586c6bef0c53998af716

SHA256
5106bc9c028ac5c59d7039f331f65f996697c507ab46baa284bf7b76976d2037

SHA512
63cfbc091191a42ccd8d660f82dd7789b8f826a436e2444d3f25614572d8f65dc64411c706869dd2a5f5a66ab97472ff34d13a36b13896c268b0011c4891d2a1

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
81f91a3324d808ed26f1a90432c09955

SHA1
9f2517f125564f64400077d9624a81ec32bd6691

SHA256
90527e5c825f371ad839803f3d77792a3411a5aec740879ff2d6bc9f04c3017d

SHA512
fa171976ef8f5735015a220ab38570dedf7e5f9e6a72304d57275efeacc61baa03c52210aa435c19f91016f0b88bf862f59f47f516166f5748fc5f176149ea70

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
ba137026adc93093de011ce83414241d

SHA1
5ebc05464ce452c0159b47c3e52fad8de5a6b5b9

SHA256
ba3616201a96b76f40a724162b7578f8a38255d989e53a8a7ec0500cef2bee6c

SHA512
c413a3c9d5c5576842384ac139827d871f3b25c8c78ea7c9810e9f666baadc619799f0328a4044e0449cae7ff05fd95a2e82d44080af82e5d1f9a97843420436

Download Submit

Analysis

Sharing