Malware Analysis Report

2024-09-11 08:39

Sample ID 240610-312rfawckb
Target 7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783
SHA256 7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783

Threat Level: Known bad

The file 7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:59

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:59

Reported

2024-06-11 00:02

Platform

win7-20240221-en

Max time kernel

128s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1968 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1968 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1968 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1968 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1772 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe

"C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fa1cd327b18f11b1040f9e725b078eb3
SHA1 6109e49352ac8c49aa2b0a0a8e6127dee8bf6e5d
SHA256 a9d7ebc6e89dc13d73884fa876ea7c076faa170342dc11d361db45d77a35b1e2
SHA512 101cb6333da3dffc135c97dee3cbd6f54bbde0348df425f89e16f2549efa4e8543cee99ae8e62cd64accd9bf5f82e4420f41eab6c2964ddb39cdae7c28e7f231

\Windows\SysWOW64\omsecor.exe

MD5 dc2ef02c1bce30d3da9b2f90e2496ddb
SHA1 82c569f6d378204f5eed59247f744d26b8710677
SHA256 77bc4b1937dafb20f9ad560ec612fdc5615ea572788fc7ca14496fe9a59a9c16
SHA512 df3af5faecd6a0706334a66039074babc2e41bb44b61ba04fc834317500e0da7637906d6bbdc5835e01c290762f3c9fc2d8fb93d4a09bc0b52c4dad9a06bf60f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:59

Reported

2024-06-11 00:02

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1388 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1388 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1408 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1408 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1408 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2452 wrote to memory of 1744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2452 wrote to memory of 1744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2452 wrote to memory of 1744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe

"C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fa1cd327b18f11b1040f9e725b078eb3
SHA1 6109e49352ac8c49aa2b0a0a8e6127dee8bf6e5d
SHA256 a9d7ebc6e89dc13d73884fa876ea7c076faa170342dc11d361db45d77a35b1e2
SHA512 101cb6333da3dffc135c97dee3cbd6f54bbde0348df425f89e16f2549efa4e8543cee99ae8e62cd64accd9bf5f82e4420f41eab6c2964ddb39cdae7c28e7f231

C:\Windows\SysWOW64\omsecor.exe

MD5 3e1929c7b7c659bdfd8a9d54928ee96b
SHA1 59ea9e04c3c8fa81857ea916064d6885c31079de
SHA256 7027f337c74206c20e3a2ecd74c99b0598cd526b50cf79f91efd4980efb598f4
SHA512 d84ab811b925a4832bd05f844eee18b85f7473ecf8929ad1ca15fc0af09014582d800e21111d6ee8f4e7848269fc02f5ee4bf68c3c55f461cce8fa28d5888673

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 968955cee8159b2ce0c7b8d9d0197ab6
SHA1 e8c524b470bcbb5b9c6cf5fbc21a0507f96a7987
SHA256 d3bc710d078f05ce7c09fcb186ce57f313b8fb7990ee914dee8dd8f2901bb773
SHA512 0f19688026164d78cd485b04fb22c760dd0ed91fc0b9495863e9da9ab4f6dbed7a1ceaee62cb3cfed245b928d906e2eac3d1ea8144afa4b3e8cd2e9712ec5eb1