Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:12
Behavioral task
behavioral1
Sample
d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe
Resource
win7-20240419-en
General
-
Target
d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe
-
Size
62KB
-
MD5
2dc22d980de05b688bf73cdfbd82ac35
-
SHA1
795fab98c90da6ed2984cf2fc636d54f2a143ef7
-
SHA256
d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0
-
SHA512
64a89d9a22c7f1b55cf1933010dc234048624f196eaedc83f3934653afef105f6fc15dd4dc028f75a3387bf083f17cb6b729b0d05a3f2d6209c6fbbab951e336
-
SSDEEP
768:vMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:vbIvYvZEyFKF6N4yS+AQmZtl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 1988 omsecor.exe 2676 omsecor.exe 1784 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exeomsecor.exeomsecor.exepid process 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe 1988 omsecor.exe 1988 omsecor.exe 2676 omsecor.exe 2676 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exeomsecor.exeomsecor.exedescription pid process target process PID 1736 wrote to memory of 1988 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe omsecor.exe PID 1736 wrote to memory of 1988 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe omsecor.exe PID 1736 wrote to memory of 1988 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe omsecor.exe PID 1736 wrote to memory of 1988 1736 d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe omsecor.exe PID 1988 wrote to memory of 2676 1988 omsecor.exe omsecor.exe PID 1988 wrote to memory of 2676 1988 omsecor.exe omsecor.exe PID 1988 wrote to memory of 2676 1988 omsecor.exe omsecor.exe PID 1988 wrote to memory of 2676 1988 omsecor.exe omsecor.exe PID 2676 wrote to memory of 1784 2676 omsecor.exe omsecor.exe PID 2676 wrote to memory of 1784 2676 omsecor.exe omsecor.exe PID 2676 wrote to memory of 1784 2676 omsecor.exe omsecor.exe PID 2676 wrote to memory of 1784 2676 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe"C:\Users\Admin\AppData\Local\Temp\d4a1372727c91b8be90707d2448684dbadeca4a515376d3cc7cfffd85fc7c8a0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:1784
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5ad112a7823e24e6b70a6a425bd8545e9
SHA1e13ae8a94a2e01f2051bf78d72a627eb513d1032
SHA256650acbbc5a72fe3bbfe1cb96ed6617c34cfe7422c7d16c267a8ac3b67e39530d
SHA51208534dde254180a13072311c2f2e815bb162c2bbe7efc99f55a421ae03d9751f57063114c8d27af41bf3a50f0703c9711dee02323ed6be04f30f28fca353b3e3
-
Filesize
62KB
MD50e656ff6fc57f656d2182deefd6938df
SHA18dd6471e7585e3cc327364046941d3bf93f06cdb
SHA256d66cdc6241d7e2a7c7d442cf5d011ea9ffdb166c2dda6be0654042a5f5c9f7bf
SHA512144352bbd577be1da1cb945f3e00851205ef933e3a34c71bb4ef4a4dbedbb3ca2694f72f8be19bf7318b152d9828d9c56292d55adf1dc14532ecb7ee309fb8e1
-
Filesize
62KB
MD5540282c922cf0bdd6edc2649327bb237
SHA10d436806b6864bae793be513766e94b3d18ea840
SHA256587fb03494f22e4979d1f75c7d0528cfb7083fcfe9ef57f576e4d130306d31f6
SHA5120a55ef516e8480ef6159ccc3bdc643a746762b1b42045ba87cb0108052ee0ccc6a20b1189357debdf199312e7aa764013174db0c7d4923f28f3cee5153520591