Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 20:48
Behavioral task
behavioral1
Sample
3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe
Resource
win7-20240419-en
General
-
Target
3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe
-
Size
84KB
-
MD5
756384dff6e690c32681a2439a718d8c
-
SHA1
6c9e4c6381e24572d506991cd3b22e6ca3102c94
-
SHA256
3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d
-
SHA512
5f7c1e01eebe65d1a87430af919175d818fc1f1b87d52fa4814be8ab9c201a719243aa160606aca3d8728e1949164c08d824929501306b345fb3d3389515c843
-
SSDEEP
768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:zbIvYvZEyFKF6N4yS+AQmZTl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 1252 omsecor.exe 2884 omsecor.exe 3016 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exeomsecor.exeomsecor.exepid process 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe 1252 omsecor.exe 1252 omsecor.exe 2884 omsecor.exe 2884 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exeomsecor.exeomsecor.exedescription pid process target process PID 1432 wrote to memory of 1252 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe omsecor.exe PID 1432 wrote to memory of 1252 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe omsecor.exe PID 1432 wrote to memory of 1252 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe omsecor.exe PID 1432 wrote to memory of 1252 1432 3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe omsecor.exe PID 1252 wrote to memory of 2884 1252 omsecor.exe omsecor.exe PID 1252 wrote to memory of 2884 1252 omsecor.exe omsecor.exe PID 1252 wrote to memory of 2884 1252 omsecor.exe omsecor.exe PID 1252 wrote to memory of 2884 1252 omsecor.exe omsecor.exe PID 2884 wrote to memory of 3016 2884 omsecor.exe omsecor.exe PID 2884 wrote to memory of 3016 2884 omsecor.exe omsecor.exe PID 2884 wrote to memory of 3016 2884 omsecor.exe omsecor.exe PID 2884 wrote to memory of 3016 2884 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe"C:\Users\Admin\AppData\Local\Temp\3ec432747a3cfa0dc243b89ababf8f60f60eed10e9027ce31f2526e7c297e95d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:3016
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5db6ff8d832660f61d66a6f5a22fd9830
SHA188594363b258506bc228e2d6dc7b95e1173a16c0
SHA256bb927993eae2d22117651936ded9f7f7a00d964ba42acf8975af8fdfb831c8a5
SHA512638baf7fd32a6c8021046e0161edd82aa836fc2056e431b76917d09676a4982f2eab18eccf57242a7fe535f7447c293e7af5abe068a5621c177b277956cd1bb6
-
Filesize
84KB
MD5b1e82e612338f5c2d997a8be52666a5e
SHA1fa8d6f22d1e4e1f6dda94d03fe19f374d8f46600
SHA256009f78164c8b64e6e59b7e6a0988e6efbc8ae815e2171433aecfd44771563de9
SHA5121f53666846fe5c44a2f6d77a559defb22f083aee673d6d268a8988e5c8951637ff709314dfc3e3e033aa8a3ac26d81d5d0dee82157a4deb5529b94c2f3b3e81d
-
Filesize
84KB
MD515358bbbaee7a5629bb0ab8a06a20d9a
SHA1b222268c5e0d6b8a2d9865a2e7542a1064c296af
SHA256374cd60d5987a93e3a477dc21aa1989f2524cee2c7595ca10f8efde11c70ec66
SHA512ac505f34f632a55ea10aba05b9a6a04e477a17539173c6eea746a0faf2db164b67a73cb27c12e7111e9f520cd4be1b7eab71d98df30892e14a49417d617f3a2d