Malware Analysis Report

2024-09-11 08:38

Sample ID 240609-ra4bssbh85
Target fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486
SHA256 fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486

Threat Level: Known bad

The file fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486 was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

UPX dump on OEP (original entry point)

Neconyd

Neconyd family

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 14:00

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 14:00

Reported

2024-06-09 14:02

Platform

win7-20240215-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1716 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1716 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1716 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1716 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1768 wrote to memory of 1268 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1768 wrote to memory of 1268 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1768 wrote to memory of 1268 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1768 wrote to memory of 1268 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe

"C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2980-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a17bf18357316df314199e2e33b196ea
SHA1 2ae3769c1ac36b87ce8ae5c849666697d670185b
SHA256 18c9a3812e5b8ed7427e7900c73120d25bf614c391b1e2b657723740e768bd0b
SHA512 a0eb415ef6f3022ebb4c44f084c843571ff16bfca7c9b79d14259cab1a0119d004997f41d370da5dcce0be534843d2cbb07a58a3f9ad267ee1fa41046c6f38ec

memory/2980-3-0x00000000005C0000-0x00000000005ED000-memory.dmp

memory/2980-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1716-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1716-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1716-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1716-23-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 c0eadf00e84a73691c7f6a0ae9526e60
SHA1 8840b5a1e1be568ed9a9c928fb69328782ad2640
SHA256 5610df1c0f1d5fcd13539e3097ea7e2456d4795dc394623284df0a8748471979
SHA512 0277837e7a6f9a2edb4d0d759321d0ea5673f5f46caa1ce6c76cd62429ba655013cdd60ff378d3954ce412d0ea655c47759531eab3325c4bc5290033dcb0de11

memory/1716-26-0x0000000000310000-0x000000000033D000-memory.dmp

memory/1768-37-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1716-34-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 f872c8966d1f5920ef50e2a24863591d
SHA1 0da78760d705676d606f3f8f269c3c40ecaa935c
SHA256 70bd26c73f5feaf4f72f80300701ed1c3a6cdd6d200dd550b3b16ed166eb76b2
SHA512 2fab512d57b8957443cdcb22997b377063926e373f8a7970b7c3e43098086d6d74edc4b6458411e276176427a55dc9a371a7e5e39e2e7bc173e8bc4f43236039

memory/1768-46-0x0000000000220000-0x000000000024D000-memory.dmp

memory/1768-43-0x0000000000220000-0x000000000024D000-memory.dmp

memory/1268-49-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1268-52-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 14:00

Reported

2024-06-09 14:02

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4780 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4780 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5092 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5092 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5092 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe

"C:\Users\Admin\AppData\Local\Temp\fe2895a9f0aa42a65b03c9829a2dfb77d1d4bd5d5cd870533422052fbeebc486.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 66.229.138.52.in-addr.arpa udp

Files

memory/4780-0-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a17bf18357316df314199e2e33b196ea
SHA1 2ae3769c1ac36b87ce8ae5c849666697d670185b
SHA256 18c9a3812e5b8ed7427e7900c73120d25bf614c391b1e2b657723740e768bd0b
SHA512 a0eb415ef6f3022ebb4c44f084c843571ff16bfca7c9b79d14259cab1a0119d004997f41d370da5dcce0be534843d2cbb07a58a3f9ad267ee1fa41046c6f38ec

memory/5092-4-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4780-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/5092-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/5092-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/5092-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/5092-14-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 50c79d932344323f610095aa1c425244
SHA1 7b90a5575f26370e20cb6755c934bea1ce3c4566
SHA256 ce114bb478c1f2494e86902fc007f0dc3b40a406c3bb329148cd7881326c71a5
SHA512 e9cdc8c727d4102c413f0287d36315b776ede5604de3e61ee9fddcd40ef34cfed42761d335826e1035f8c7445161621768018aca86b85ed97f00e7526bdab6c5

memory/1068-18-0x0000000000400000-0x000000000042D000-memory.dmp

memory/5092-21-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1068-22-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1068-25-0x0000000000400000-0x000000000042D000-memory.dmp