Malware Analysis Report

2024-11-16 13:01

Sample ID 240519-wv4khsah92
Target 03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820
SHA256 03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820
Tags
neconyd trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820

Threat Level: Known bad

The file 03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan upx

Neconyd

Neconyd family

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-19 18:15

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 18:15

Reported

2024-05-19 18:18

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe

"C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 171.255.166.193.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 35.91.124.102:80 ow5dirasuek.com tcp
US 8.8.8.8:53 102.124.91.35.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/3724-0-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0b8337b47be228f5d9a0c04845729262
SHA1 d7046b7363126715d7b28b450af9c9025d813417
SHA256 444a7ea04a6e7e3f6f190c936605194e52d9f5c6421ce86327916beb7da8ae8f
SHA512 8bb1fb752dd5375afc8ed3162fe632e7b9d8bcf8949de621844528e3606887ab186d3c2827090675df1bd75d9c0537a4df3529343ce576d4397c74c5a1dd8b6e

memory/3724-5-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1284-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1284-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1284-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1284-15-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 981c84739f904bb3cd1e98a07e2ff25c
SHA1 4f72607174260881af5697b390b3f54eb0ef6e6b
SHA256 1cc6b5ab9edf60366ff2bbf8a8e032b6a335f6970a26698bae34bf9145fb7065
SHA512 ff3701fc72da220d33cca337fa83a0c67b08ff626ea9c47020f5eddf1052dfd83327d771985e271a55bc63c17ec5745d871fbd44a94a576ca9bd753d8daed161

memory/1284-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4508-21-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4508-26-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1a1e5cee38301e50d75aaf8a06f59446
SHA1 d57fa8331f4b400cd9f353cfd3d17fb79a8749e5
SHA256 df203312a86c68973ad88d1b4ebc95ceed679bfe50b0c53fc80f9748cec13063
SHA512 a62e84cfa465eca926949434cd4b3c69e5986e7bf77ea5f4ed507a0a95302e3b3e748ab9a8d342405287a5c7ec25e02b33b150fa0a4ce25039e5fa1b59f4fe14

memory/3164-28-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3164-29-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3164-32-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 18:15

Reported

2024-05-19 18:18

Platform

win7-20240508-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1708 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2444 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2444 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2444 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2444 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1516 wrote to memory of 1872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1516 wrote to memory of 1872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1516 wrote to memory of 1872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1516 wrote to memory of 1872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe

"C:\Users\Admin\AppData\Local\Temp\03c941f677711b137d30dc431257a226b5a5493acdc1f931f2b2ce1c7f0a7820.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 35.91.124.102:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1708-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0b8337b47be228f5d9a0c04845729262
SHA1 d7046b7363126715d7b28b450af9c9025d813417
SHA256 444a7ea04a6e7e3f6f190c936605194e52d9f5c6421ce86327916beb7da8ae8f
SHA512 8bb1fb752dd5375afc8ed3162fe632e7b9d8bcf8949de621844528e3606887ab186d3c2827090675df1bd75d9c0537a4df3529343ce576d4397c74c5a1dd8b6e

memory/1708-4-0x00000000002A0000-0x00000000002CD000-memory.dmp

memory/1708-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2444-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2444-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2444-17-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2444-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2444-23-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 5678eb9d4df15d70c465362dbed79900
SHA1 4c344180092267fdb80e497c23b1fb3a84a1eb55
SHA256 532f1e4960cb10c32058615e944050be9423cb2babc9d56c02a47851d56a4c13
SHA512 d2a301e9542fd5773191755656a8de790552b2e727d1ea87a227d8861ef7dae6b7e018c281703943f15237c448d3c4f2facd5db44f42e4c576a7948fcba296ed

memory/2444-26-0x0000000000320000-0x000000000034D000-memory.dmp

memory/2444-33-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1516-37-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 f42c19e70c2bf60a3165feac22c205e8
SHA1 1285e0191642799eee96b905a9118946b22be516
SHA256 b849be64b6ec58db3a44d3246508bd00b0b2dd3f6a52f3600bccaedb86c96a56
SHA512 21a8e60e3af24a0ef45923f22a514ff5c1945414ed85a67943c587de6fe071eeceaee18b80474aacb11dac4fd286489e575e8706485f1ad3f3cfc56bc37a7943

memory/1516-45-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1872-47-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1872-49-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1872-52-0x0000000000400000-0x000000000042D000-memory.dmp