General

  • Target

    e99981ec088fb15d0d809a753cdd9a9b7ea91fff3cd80a4c49b275e82d11ceb1N.exe

  • Size

    96KB

  • Sample

    250202-t5nwpsskek

  • MD5

    edb0f3c415f5f4d166acffcd3fe73d90

  • SHA1

    e419242d88054f65467983b78bf7ffed4cae44d2

  • SHA256

    e99981ec088fb15d0d809a753cdd9a9b7ea91fff3cd80a4c49b275e82d11ceb1

  • SHA512

    89da9f72f78ac9c2034d378793771963a207871ca82ec6742bcb12a92ee41c8b3e89d9104ee58a993b7ecf85f75c2fb00a22e04a3dd747f768b1cb6c6ddc6457

  • SSDEEP

    1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:JGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      e99981ec088fb15d0d809a753cdd9a9b7ea91fff3cd80a4c49b275e82d11ceb1N.exe

    • Size

      96KB

    • MD5

      edb0f3c415f5f4d166acffcd3fe73d90

    • SHA1

      e419242d88054f65467983b78bf7ffed4cae44d2

    • SHA256

      e99981ec088fb15d0d809a753cdd9a9b7ea91fff3cd80a4c49b275e82d11ceb1

    • SHA512

      89da9f72f78ac9c2034d378793771963a207871ca82ec6742bcb12a92ee41c8b3e89d9104ee58a993b7ecf85f75c2fb00a22e04a3dd747f768b1cb6c6ddc6457

    • SSDEEP

      1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:JGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks