Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:39
Behavioral task
behavioral1
Sample
f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe
Resource
win7-20240221-en
General
-
Target
f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe
-
Size
62KB
-
MD5
3f4026511c6890875837a13675b7278a
-
SHA1
e84c8733260773cc688b68ad4d0d2812c4904287
-
SHA256
f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6
-
SHA512
80690676583813b52e7974ab1ddd64a596b87990dcafbd14fee520d481dee44d27c509929ff26a5d721e2272e38bc22789da3b57be1c556ed3f509e6823dd784
-
SSDEEP
768:eMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:ebIvYvZEyFKF6N4yS+AQmZtl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 1712 omsecor.exe 2752 omsecor.exe 1820 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exeomsecor.exeomsecor.exepid process 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe 1712 omsecor.exe 1712 omsecor.exe 2752 omsecor.exe 2752 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exeomsecor.exeomsecor.exedescription pid process target process PID 1688 wrote to memory of 1712 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe omsecor.exe PID 1688 wrote to memory of 1712 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe omsecor.exe PID 1688 wrote to memory of 1712 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe omsecor.exe PID 1688 wrote to memory of 1712 1688 f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe omsecor.exe PID 1712 wrote to memory of 2752 1712 omsecor.exe omsecor.exe PID 1712 wrote to memory of 2752 1712 omsecor.exe omsecor.exe PID 1712 wrote to memory of 2752 1712 omsecor.exe omsecor.exe PID 1712 wrote to memory of 2752 1712 omsecor.exe omsecor.exe PID 2752 wrote to memory of 1820 2752 omsecor.exe omsecor.exe PID 2752 wrote to memory of 1820 2752 omsecor.exe omsecor.exe PID 2752 wrote to memory of 1820 2752 omsecor.exe omsecor.exe PID 2752 wrote to memory of 1820 2752 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe"C:\Users\Admin\AppData\Local\Temp\f6a9454dcc4624fde6b84056dfeabd85941a8793a7d1adb15970a48216c441d6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:1820
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD58be5abf1ca351315c8984e876c3e6224
SHA16c06a8bbbd810d9efad2beb902005575b98c74b9
SHA256d7d0ad6344b2659ed53545bda1163021924c6b8250cd40028f5b2f87cad16e2b
SHA5128aaea9feffa115e782b5b2693740302267e539e4aff302d85d9f60393258908e6f7363570a7b081e929d5e17515e49354f9615771d020e446acc36479e342031
-
Filesize
62KB
MD532253a47273278b1128b91830b267488
SHA1eda4aab36b06bfd22ca9a9235342df67dca71993
SHA2562ace238d95b0fb8fb6ccef4822cd9cccc76d131bb87dcff53424999430349249
SHA5128def47f16e1856a0c0cedd955853f40a4771fd7d2ab66b076ae76e28796b6de3e8d2291627bc6138cfea34531688bc6c69a06c0c6318478dd19fdeb540f85463
-
Filesize
62KB
MD5110af80ab7627254d0bdfb33da0fc9d1
SHA19f1f948edad862f1d60bea286217777593054894
SHA256ebbb47554a3b81278e46c6c7c166078a5ab43967a8c99501c2029419480f021f
SHA5120c46616e88342ebaae44dc3b22d555dc4f3aebbad28a06ad7e89d1b9be08b1479380c2c676849eb9fce910b6fa784617dd1dded6e0fc7cf1bc8bd2056ec5d1b5