Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 01:51
Behavioral task
behavioral1
Sample
b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe
Resource
win7-20240508-en
General
-
Target
b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe
-
Size
76KB
-
MD5
a31f5588941539c4e5a2baa4764af7f3
-
SHA1
fe836b26ca19e19909547d6e209bfda9d51e403c
-
SHA256
b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4
-
SHA512
a1ebb762819dcb1fc321ae87a304170b20ef13fc58bd8c951f3f87fd548766e799a27c933b038730d516b10a93aff0f2d112170f4b3e35cfde7dfc95e2dd7362
-
SSDEEP
768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2144 omsecor.exe 2648 omsecor.exe 1976 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exeomsecor.exeomsecor.exepid process 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe 2144 omsecor.exe 2144 omsecor.exe 2648 omsecor.exe 2648 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exeomsecor.exeomsecor.exedescription pid process target process PID 2136 wrote to memory of 2144 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe omsecor.exe PID 2136 wrote to memory of 2144 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe omsecor.exe PID 2136 wrote to memory of 2144 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe omsecor.exe PID 2136 wrote to memory of 2144 2136 b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe omsecor.exe PID 2144 wrote to memory of 2648 2144 omsecor.exe omsecor.exe PID 2144 wrote to memory of 2648 2144 omsecor.exe omsecor.exe PID 2144 wrote to memory of 2648 2144 omsecor.exe omsecor.exe PID 2144 wrote to memory of 2648 2144 omsecor.exe omsecor.exe PID 2648 wrote to memory of 1976 2648 omsecor.exe omsecor.exe PID 2648 wrote to memory of 1976 2648 omsecor.exe omsecor.exe PID 2648 wrote to memory of 1976 2648 omsecor.exe omsecor.exe PID 2648 wrote to memory of 1976 2648 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe"C:\Users\Admin\AppData\Local\Temp\b4c09a6487a7c9260202bd1eb3178f92284a4b0a40bd99d6d8d7171368d465c4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:1976
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5495f99da6f9325c15747e701f6a5acc0
SHA1347efe456007d950712cd40022d5c5f62077b0eb
SHA2569c1864811146f9dc145ab0a67b59d23dd61422b25d1321e14516cd13025a76e0
SHA5127f739ca8a988849a900dc4743426814088cc6287f46484ad3297ff9b4b80e0430caff4c32f8406f8cf2bab8f180a923b0ee51ba1f19bb55983d2d55b0f4f36c2
-
Filesize
76KB
MD5aebb4fcd284ced53358f39c8d85d39af
SHA1f75dff9d554917e620cfe39d6c332765bed4a9e0
SHA256342902995e3d01769e32b65d9681ad968e2dc672a9c8e8e2e76aa2f69dbf9dc4
SHA5125573aa77c6204c52338c1138f68aa9dd9d3880611be1751ebb621d072da2c898df381d33817201db5849f2723d492d80b191273de23d1ee1ed51c67bddaed86a
-
Filesize
76KB
MD51bc2ef67815238cef42d96c72c0faf52
SHA1c4830e7f0619643ec68705db3d304502276b7bb0
SHA2566a4079a5d47c58172f8f44fc54338fb397091b80a59248931d7a731f60211946
SHA512393b614e23a4bb5048f7a8202e8b04bd4500f62b26161a08525b7330b6ddd24f3c002dae4531cd78bed6eda0320b35eafe81cc256569919985c01d75778cc898