Malware Analysis Report

2024-09-11 08:38

Sample ID 240609-cm42jaca7v
Target 73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910
SHA256 73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910

Threat Level: Known bad

The file 73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 02:12

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 02:12

Reported

2024-06-09 02:15

Platform

win7-20240221-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1524 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1524 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1524 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2856 wrote to memory of 1500 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2856 wrote to memory of 1500 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2856 wrote to memory of 1500 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2856 wrote to memory of 1500 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe

"C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e211d2ea1767dca3af915d18598f8cab
SHA1 05c7e79107bfff36afbc05187940b9f3ec0788d8
SHA256 1fc22615248d9c796ab0784c05a829dcf962ee8b8c94dd92916a05a07c039c67
SHA512 8a95e10ee9f186dc66113162fbdf9e557fba3d554bb45fbc50cf8510387dcfc66da568b143dba11684a4266871c7780394019a72d4acf85ebbc41dd3367e8065

\Windows\SysWOW64\omsecor.exe

MD5 1f2772e19057848ddd617e27535858cc
SHA1 ed1541a52fbc4267eff0a01a5c6e105172de55b7
SHA256 0bbe32885a6179e5c55ab93f11fb0ce3e31af63c0b3c39a59233a243bea32417
SHA512 a45590a9b5750d012074e808de3a5b43da7ba392e4cf392ce7a7338f1ddde22eed8025a26b25a647c66d9db45c1d4abb78d1d3346e2c34a51f5e2cc62a918114

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4175783b37c3927e302b3bdb12ddcc8f
SHA1 0e53c266169cdf271e6d9297b3a17abc46185b5f
SHA256 90aa5f1ab5aab252ac2b49fc4cd441aa90e02e771841dc5f8622882ef20ba3dd
SHA512 045c7a5a1e22f26a420351b2553afed6cd006a846ad6676e6d63bc512b269d256facd6b327b90a156db32708103dbb7a7e9ed801059a1bb26670613ca61f8b34

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 02:12

Reported

2024-06-09 02:15

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2280 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2280 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2280 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4072 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2184 wrote to memory of 4488 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 4488 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 4488 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe

"C:\Users\Admin\AppData\Local\Temp\73f21e7b2f4c2847f7123d76bd43feb7f237eab5612bc5f45fe9e0e7e89a6910.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 171.255.166.193.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 94.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e211d2ea1767dca3af915d18598f8cab
SHA1 05c7e79107bfff36afbc05187940b9f3ec0788d8
SHA256 1fc22615248d9c796ab0784c05a829dcf962ee8b8c94dd92916a05a07c039c67
SHA512 8a95e10ee9f186dc66113162fbdf9e557fba3d554bb45fbc50cf8510387dcfc66da568b143dba11684a4266871c7780394019a72d4acf85ebbc41dd3367e8065

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ca4b7e9cde5913bbfa47fa90f056ebca
SHA1 135cef0fd7cdd8de006de82215d3021af72f70c8
SHA256 e1d90623eb3addd04effd51d0b9c6bcaf805e98ac07f3acf2e0282cf4f138ea4
SHA512 906537456f44ed5d571498bf109e2f202f1f37302c3a853319e7ac6f4ed3683a3204621cff6295b44ad18f7aace91d4b459daca4f15b25a650b32818435fb1b6

C:\Windows\SysWOW64\omsecor.exe

MD5 d4e2d6ae394ab55cfc6ce552f637026e
SHA1 59834da11ee0675bbcf1a29b0b371de92783dcb3
SHA256 4e465420ff96bcd159e2d1f1b3889c49136cf4a88f0a07f707294aa24aa874ec
SHA512 9b2cce26472687be10ffd2591279cb1d54d4c9046c5f1c5f7f24e1031e155f781a22a5e71e671a6e3c555ad65fe91053adc1cc6ad0b29716e56a7897826842cb