General

  • Target

    ba6eb9f761f2416818a2162ca9d21d35e51aeea7a16bf7263012e433e11f2e2fN.exe

  • Size

    96KB

  • Sample

    250205-d1x1taymgm

  • MD5

    be2151ab0a35c54a3e6cbd72d9c6f5e0

  • SHA1

    2841882d71adcf31701c778c43d47c558ee7c266

  • SHA256

    ba6eb9f761f2416818a2162ca9d21d35e51aeea7a16bf7263012e433e11f2e2f

  • SHA512

    6375ea85905f966b83064da626262af86984357608cef45afc9caa420d2695d43a7738cb30e706173277bcf3a9502a2656b81f7837a0d610b40c6020bd3374ca

  • SSDEEP

    1536:pnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:pGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      ba6eb9f761f2416818a2162ca9d21d35e51aeea7a16bf7263012e433e11f2e2fN.exe

    • Size

      96KB

    • MD5

      be2151ab0a35c54a3e6cbd72d9c6f5e0

    • SHA1

      2841882d71adcf31701c778c43d47c558ee7c266

    • SHA256

      ba6eb9f761f2416818a2162ca9d21d35e51aeea7a16bf7263012e433e11f2e2f

    • SHA512

      6375ea85905f966b83064da626262af86984357608cef45afc9caa420d2695d43a7738cb30e706173277bcf3a9502a2656b81f7837a0d610b40c6020bd3374ca

    • SSDEEP

      1536:pnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:pGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks