neconyd | d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34

General

Target

d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
Size

96KB
MD5

bd7713ed8422c64dff66486d55ce4a50
SHA1

5d94eb3814fcc4b464f025075ccf78aa7789b71f
SHA256

d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34
SHA512

c4482819a5463759c1a79c14147472ce1542eb175d788d394358ea3ee70909dde733f2b0523e240abda86ea339479081d0f4d75eef74a75a89e06876573c9ac5
SSDEEP

1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:4Gs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2536	omsecor.exe
4956	omsecor.exe
1980	omsecor.exe
1456	omsecor.exe
4788	omsecor.exe
4308	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 2536 set thread context of 4956	2536	omsecor.exe	87
PID 1980 set thread context of 1456	1980	omsecor.exe	109

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5048	2980	WerFault.exe	82
5024	2536	WerFault.exe
1092	1980	WerFault.exe	108
1052	4788	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 2980 wrote to memory of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 2980 wrote to memory of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 2980 wrote to memory of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 2980 wrote to memory of 4680	2980	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	83
PID 4680 wrote to memory of 2536	4680	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	86
PID 4680 wrote to memory of 2536	4680	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	86
PID 4680 wrote to memory of 2536	4680	d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe	86
PID 2536 wrote to memory of 4956	2536	omsecor.exe	87
PID 2536 wrote to memory of 4956	2536	omsecor.exe	87
PID 2536 wrote to memory of 4956	2536	omsecor.exe	87
PID 2536 wrote to memory of 4956	2536	omsecor.exe	87
PID 2536 wrote to memory of 4956	2536	omsecor.exe	87
PID 4956 wrote to memory of 1980	4956	omsecor.exe	108
PID 4956 wrote to memory of 1980	4956	omsecor.exe	108
PID 4956 wrote to memory of 1980	4956	omsecor.exe	108
PID 1980 wrote to memory of 1456	1980	omsecor.exe	109
PID 1980 wrote to memory of 1456	1980	omsecor.exe	109
PID 1980 wrote to memory of 1456	1980	omsecor.exe	109
PID 1980 wrote to memory of 1456	1980	omsecor.exe	109
PID 1980 wrote to memory of 1456	1980	omsecor.exe	109
PID 1456 wrote to memory of 4788	1456	omsecor.exe	111
PID 1456 wrote to memory of 4788	1456	omsecor.exe	111
PID 1456 wrote to memory of 4788	1456	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
"C:\Users\Admin\AppData\Local\Temp\d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
  C:\Users\Admin\AppData\Local\Temp\d6caa8df97406bcf24055c2b8de28cd651bc6aa9740abb1a2b0c16a654104e34N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 256
        8⤵
        Program crash
        
        PID:1052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 292
        6⤵
        Program crash
        
        PID:1092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 292
      4⤵
      Program crash
      PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 300
  2⤵
  - Program crash
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2980 -ip 2980
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2536 -ip 2536
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1980 -ip 1980
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4788 -ip 4788
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
3a090f39f732307373380b0a33b6806d

SHA1
41606e9188d956b1c3683ac588c3d4a0d4e994ae

SHA256
33e6e6c57e92b416ccf86d428c95ab2bc7ef48b36436191e89abe57cb02d425d

SHA512
8c4a92947298ad2737a4a926277763ddf4c8b1880ae17ef9fcb87ebc5e7927663352459267fc394bce31459e7871f6e846b8528424927e2ecc81ab14ceb457b3

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
512f76a6893c4c0d8dbd41e98d5141c9

SHA1
d1f99ae83f1c728bb65a3b1283aaa7660a77eb76

SHA256
93c73f0acb04d9c61a144afd7abb02bdd748cf9ea7d867e720cbe61ca53c3ad9

SHA512
2171d65ce8943ec51902e98dccb24eb99a48ea991bddcd496e48a40ea0123610589a42e708902577e5dfd518bf25397413abb988947f5c83a251057df0a501af

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3d5564b81918febbb6e87a30c10b4bfc

SHA1
f6872e3893d7fe6f806a2f37f5f10a8c73529473

SHA256
6738ba7ff7912da6e120ccd01e7982dda112ae194b9116861cf30225ef23ce68

SHA512
5ec3dccc54bac8f42646f2543be2ff007b632711c54b90bc8f139828064ea22f29b8d39eed66f6c5b4c4c110b5ce4e52c201b4d1e4d091d173d885ee1532d384

Download Submit
memory/1456-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1456-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1456-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1980-48-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1980-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2536-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2536-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2980-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2980-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4308-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4308-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4680-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4680-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4680-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4680-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4788-43-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4956-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4956-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing