Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe
-
Size
96KB
-
MD5
ab41e88c52a23429a5a87e173ce564b0
-
SHA1
2dd6b77fda9bd44183ecab4198766f71c34341ac
-
SHA256
1de2f735c0692b61e66831d6bc63b8d81a7c97c632d54e5f975c59a30f3655ed
-
SHA512
78cc030cad9e575623478f3a2c35e6350eb2614c60f7b782c174bc02116d45007aaa5f00f0b4b40b58357a8da7b895ab20257b14b109815e94f0f8ccceeaf4b1
-
SSDEEP
1536:YnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:YGs8cd8eXlYairZYqMddH13L
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2616 omsecor.exe 2660 omsecor.exe 1876 omsecor.exe 1268 omsecor.exe 1592 omsecor.exe 1956 omsecor.exe -
Loads dropped DLL 7 IoCs
pid Process 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 2616 omsecor.exe 2660 omsecor.exe 2660 omsecor.exe 1268 omsecor.exe 1268 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1760 set thread context of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 2616 set thread context of 2660 2616 omsecor.exe 30 PID 1876 set thread context of 1268 1876 omsecor.exe 35 PID 1592 set thread context of 1956 1592 omsecor.exe 37 -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2680 1760 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 28 PID 2680 wrote to memory of 2616 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 29 PID 2680 wrote to memory of 2616 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 29 PID 2680 wrote to memory of 2616 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 29 PID 2680 wrote to memory of 2616 2680 ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe 29 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2616 wrote to memory of 2660 2616 omsecor.exe 30 PID 2660 wrote to memory of 1876 2660 omsecor.exe 34 PID 2660 wrote to memory of 1876 2660 omsecor.exe 34 PID 2660 wrote to memory of 1876 2660 omsecor.exe 34 PID 2660 wrote to memory of 1876 2660 omsecor.exe 34 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1876 wrote to memory of 1268 1876 omsecor.exe 35 PID 1268 wrote to memory of 1592 1268 omsecor.exe 36 PID 1268 wrote to memory of 1592 1268 omsecor.exe 36 PID 1268 wrote to memory of 1592 1268 omsecor.exe 36 PID 1268 wrote to memory of 1592 1268 omsecor.exe 36 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37 PID 1592 wrote to memory of 1956 1592 omsecor.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\ab41e88c52a23429a5a87e173ce564b0_NeikiAnalytics.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
- Executes dropped EXE
PID:1956
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5797109b649c24938fb1e64b1f77942a8
SHA1daa4881fa2e85002600a12537c45f9098bb9f63c
SHA2563f0aa6fd9e220c775e3b840c83c580d8bc35ce64f208eef1cd300e693e6514b8
SHA5128b6c65d953b35826d656e5ce69a5f132831d8c7cbfcc1928392e3cc217bcec90d5a770b04b95c2500d95eb8432a2778037833c1a8de7478d74e5fd04f7561b13
-
Filesize
96KB
MD5f4a25ed4b08de0095ab6ed5cd4405241
SHA1ac56d0e7bd7f48a524df0ef4d83ca1abcde81ec9
SHA2569285e597fd3be2cbfddf5da9f97d2a034607ed4e320e4e25468b3f1faf81d0d6
SHA512c07dce108e3cc15d99e267fb4e64102e47ef1af9093f661b55c415b24798992f54b296364bbb24dc1e56c248432652ce7c231581907ec1767e3f6cce6954d18e
-
Filesize
96KB
MD5119fc7342daa727c99227bbf9c534a41
SHA1f53af1f5c684176aeeda50a045082f8d7feae181
SHA25653760679c6aac829f315d1b795ea37262d577fa8b67a7eb565aeac358886fff5
SHA5127b5559e0a2ab71523ab60c0be1adcf62019b7b72316f6d29c371a5d4ff3d5f2ac40421e669add38b4c4198af019f02a6786476e855f6a614a3b5f86b76960210