neconyd | 616efe6b6bbe5090bed7cabd398d3e8fc6a9b6273e75d527c99ed3899134371f

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 61KB
Sample261014-jckngax18k
SHA256 616efe6b6bbe5090bed7cabd398d3e8fc6a9b6273e75d527c99ed3899134371f
MD5 090d4987ea8e3314e572b12d2d229c01
SHA1 89d7c7eb99b8e5b695ed607f55441ed89716cfdc
SHA512 b08cd4594fc74b7e686e0634bc54bef19cb52654de137646b1ed1e68f974b9e7f11cf6b5dfa272ae3f4ecb1a3fbe2ba60b610b4b68caf76c0f606e70bda97d4d
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1D9538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
4576	omsecor.exe
3900	omsecor.exe
2112	omsecor.exe
5176	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4576	3708	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 4576 wrote to memory of 3900	4576	omsecor.exe	92
PID 3900 wrote to memory of 2112	3900	omsecor.exe	93
PID 2112 wrote to memory of 5176	2112	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 b5e318eed734cb608051d133db047ef1edfee19d85a46bbe8fbc7173addc7bb2
MD5 77210458e60e79c55f1c3c68b4ed847f
SHA1 426b5473829e2405c62ad17dc3bafd2f1adb98f6
SHA512 f9e97a0acd38df979ab42cfbd315f9bfc180f8b2d911d5b833db6fbfe58a4977db904af8ddcfb206b976892de7a59e1ee9cc27fa13cc1bbd7b3d65f5c464ae16
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T198538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 189f5b31ff5f53b75a45795a2ccfaddf85b7f75da18813d779331f5611eb047a
MD5 264e23cc7b468ef08016427e8b194fd0
SHA1 c1e84748e67602cd8a293feb03645f4219e74246
SHA512 5ef5a55a7492109298aafdf0db455341aa161a2b97aeb738fa5bc1c5dedfb0ace10aa26789d902574176ddf7778fcea7dd0f14aa93b98bb233baae6979c21f93
SSDEEP 1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:idseIOMEZEyFjEOFqTiQm5l/5
TLSH
T10D538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 2c78cf438c1385c7fbd2abd36f57452ca7406e3af1acea0747181d8b250cac30
MD5 31190f68db501e83edf856937f45ccb5
SHA1 58d4aa9de9287b9631a270446570efbe3fbdbcdc
SHA512 f68b3b95405c4eec604d1839675710644f00caaa2c04eea39c4998ff07c3d3f0c58ca6b3b0de355ae43f9877a044339d60ca335d91b088b8611fa2cc379f423f
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:fdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1EC538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 25f1f7865466265be5b0d71331c43d4d202af7668ee05b4973753183a3251f2e
MD5 5ef29d3cc8d8e5c49c94f60c4b356858
SHA1 5b2b002175c345adf25b5ee36f6a65dc3b987c2a
SHA512 f987805c98de6e2e04ad1bb7b0ff1e7576ded2c91636d1622df27a51c1be5bef7b0da3184453ae06a84794dcbe3e8694e047c9a0bf824d4d40096a30b62b7090
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOMEZEyFjEOFqTiQm5l/5
TLSH
T158538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads