Analysis Overview
SHA256
a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d
Threat Level: Known bad
The file a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd
Neconyd family
Loads dropped DLL
Executes dropped EXE
Drops file in System32 directory
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-24 04:13
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-24 04:13
Reported
2024-05-24 04:16
Platform
win10v2004-20240226-en
Max time kernel
141s
Max time network
151s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\merocz.xc6 | C:\Windows\SysWOW64\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2260 wrote to memory of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2260 wrote to memory of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2260 wrote to memory of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2812 wrote to memory of 1620 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 2812 wrote to memory of 1620 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 2812 wrote to memory of 1620 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe
"C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 142.250.187.202:443 | tcp | |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 23.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 3274c97d92bdca57ce3954c6537bd592 |
| SHA1 | bacd49f80520e9a6e3f12447af870da379b525a3 |
| SHA256 | b189e640c0fc7b216bf31450974619656c10f72416d334eedf263fb51c864460 |
| SHA512 | 0d14129bfe0f8f991b6a9bed0c2ce49eefa8e7a6a1e192bae499119d086c7b60c57a5c140a0adb3547c9dd1b8772ecd4f03abe2de3248e0e867fbe804c5f7fb8 |
C:\Windows\SysWOW64\omsecor.exe
| MD5 | d9fa43eee017c76ae92316e2c7ce6b0e |
| SHA1 | e6a25bea094ec3e468b25da6f8056dd87e27cd16 |
| SHA256 | 095bfb28f0a1fc75bf482d83ca53b9ba73d9305e672e110746daddbf734438b8 |
| SHA512 | 38e9a065fec766daab5a02263e6e128c50dd13d0c1a16dcfa437d7a602166c8318c55ad5ecd45c4172a3e0bbdb9c61a7ed798253c1c2bea05cec24cfb6f3807b |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-24 04:13
Reported
2024-05-24 04:16
Platform
win7-20240508-en
Max time kernel
145s
Max time network
146s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe
"C:\Users\Admin\AppData\Local\Temp\a429df49c86acbc085af51d9591e3124c756adad4a2b29439f03a73209cfe48d.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 3274c97d92bdca57ce3954c6537bd592 |
| SHA1 | bacd49f80520e9a6e3f12447af870da379b525a3 |
| SHA256 | b189e640c0fc7b216bf31450974619656c10f72416d334eedf263fb51c864460 |
| SHA512 | 0d14129bfe0f8f991b6a9bed0c2ce49eefa8e7a6a1e192bae499119d086c7b60c57a5c140a0adb3547c9dd1b8772ecd4f03abe2de3248e0e867fbe804c5f7fb8 |
\Windows\SysWOW64\omsecor.exe
| MD5 | 8ae066743239ec4218d87606b4a0dc64 |
| SHA1 | 9ba60d71ab01c08aeadf5fb5e61b0ffd55a1a6e8 |
| SHA256 | 47a9e0863f23ab4a6dd721c97f9f3cad28a0570cbfe34ecd8b7df35e1f08f4b4 |
| SHA512 | 5a83dc8df6024a04c61b0778651d03da7c5af2da8bf332cf8f081d09e6f44cd6f738a617194f2e805c2206a2a38edbca8b7ac24962342ce64a1c79cc187cfe0d |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 3a6e05d2a87373083ff9b22a0119f257 |
| SHA1 | 25faebf17987f8e47af795f1f154d3cf88663224 |
| SHA256 | 195a8aabc566d6427c8c36bba69272b43fb4ee471698ad02c7ab4d21342c5b11 |
| SHA512 | 022708e25cea1b25e5b74514d09c9eef10c1d76b9ba18693cb3e0ae867ec7d23dade5fb6e4d18d617f6dbb89455c62594c413af9991ca5c22111ecc16bf21e42 |