Malware Analysis Report

2024-09-11 08:37

Sample ID 240609-d1zjmsdf96
Target 83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350
SHA256 83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350

Threat Level: Known bad

The file 83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 03:29

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 03:29

Reported

2024-06-09 03:34

Platform

win7-20240508-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1932 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1932 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1932 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2204 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2204 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2204 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2204 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1276 wrote to memory of 1384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1276 wrote to memory of 1384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1276 wrote to memory of 1384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1276 wrote to memory of 1384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe

"C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8ff81ed280ffaca6e07676e54e21fedb
SHA1 d16628659f90934423088997ddc300cede79e628
SHA256 bceaa6b96c8aa2f9c2125c96f2f2e473d2381ce62331f8b8a28bc42d4860d477
SHA512 5c43dc8ff889be5c2424058a33d966a9f39a5871397107c509677a0ae5d44f78ef338cb4989458d836793a5e8683e51d6ebf0536a1c2d7f2a4f93b01aa3ce547

\Windows\SysWOW64\omsecor.exe

MD5 c13a44f903eea98e10059a4162844b4d
SHA1 321f6bf57b21fa1d143d426773d9a9e0d4949c69
SHA256 10929961d8b9283c995f57483a0bb3d7abbf9243770486f38993f874915b4eda
SHA512 0473a91a91caa6cb313c9acdcb333773c32d8ae70eb013d2dba3cf1795cbbe22df357ab8033052243cb1e2dd40bb74767b35255262777a17dc1d6b3d6329dcbb

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 10e9a79abd447cb6dfad8f3a23a6dd27
SHA1 6e60bca677b10fee317cadf1376355dbabe92231
SHA256 c7d233c4901c974c1d7b1a3f3f0cc872eeec1bac495c77cf24f897624077aa4c
SHA512 03981d120bdc5e4c25e75cbe828ab9b883249d718ab700880556e01fe9d0a6197acda54ce1ed658235db20f1dcc5d91dbe741ef166790f681add8ec1d462b002

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 03:29

Reported

2024-06-09 03:34

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6120 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 6120 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 6120 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4440 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4440 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1260 wrote to memory of 4848 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1260 wrote to memory of 4848 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1260 wrote to memory of 4848 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe

"C:\Users\Admin\AppData\Local\Temp\83cd2b57e98a4ccc0ef141002fe1e3b7a7e40c28122aa3ce8ce01082ebafd350.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8ff81ed280ffaca6e07676e54e21fedb
SHA1 d16628659f90934423088997ddc300cede79e628
SHA256 bceaa6b96c8aa2f9c2125c96f2f2e473d2381ce62331f8b8a28bc42d4860d477
SHA512 5c43dc8ff889be5c2424058a33d966a9f39a5871397107c509677a0ae5d44f78ef338cb4989458d836793a5e8683e51d6ebf0536a1c2d7f2a4f93b01aa3ce547

C:\Windows\SysWOW64\omsecor.exe

MD5 ac8fb7fcc4a962783f22c064b0cdb3bc
SHA1 f90da7235d5fea6bfd66449562fdf6d1aa4388f3
SHA256 dbda87d4bfca13996db5f87b1dcbdfee55d2595ad9503d2e6aae2f163aa089a6
SHA512 363d85265c6f062acb365cc540ef09edf6c058e615c658b9a1230418cb7240580240b847a7e9be267e214703c6d4296af7b98b73d3f35559888acc4c7cd4cc2b

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2b9bb124c3ae5fc9990b29dcb599f92b
SHA1 e2f66022d3dd3df8a25925e960665c5d5412c836
SHA256 a2f4d2421baf7ecbdb402169e6d8188c1807806f77b97fc100d48ff537457f1f
SHA512 881c2eea40312a0df9f11bbe6de80ee2e0348c58c369a0b13e50c1fa11c56611877756c1a78904cbfcad9c30af75c0dc07250cf8c227f951e822ccd58022ef0e