Malware Analysis Report

2024-09-11 08:35

Sample ID 240610-wwdqgswcml
Target 045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136
SHA256 045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136

Threat Level: Known bad

The file 045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 18:15

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 18:15

Reported

2024-06-10 18:18

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2228 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2228 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2228 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2180 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2180 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2180 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2180 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1460 wrote to memory of 1996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1460 wrote to memory of 1996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1460 wrote to memory of 1996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1460 wrote to memory of 1996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe

"C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d5c24b60af5ba7b3f7e109b3a7a8b58f
SHA1 8a91c444addcb898f6a853e8c83e7fc8070344fb
SHA256 84ad917c60bf03f19ea440d8bb730f189d2dfebfb4cf9e91e9b3ca27cff6236d
SHA512 9f4c0b591bfb9c6086ee92cf8a2a74d9ac9ad634227aa5e479fb546fca4731f58a9381c85b11c34d7752d80908fc38b3c726a2efe0f7554bfe78c22f9f980e89

\Windows\SysWOW64\omsecor.exe

MD5 b75e0517ce19f3e03e432a059a428fdb
SHA1 e96af8032b5a2bf2b60a97881a3165eeb278c40b
SHA256 eeffae9cd94e9572501f45c67b43c57d0f797e7009a65759ee4304c06e48434d
SHA512 925511da2ca4e001453af9985e61bb24010c27974b0d4496a914255f360ec13d2ec0fb650b83fc20caaf92ce4530c2c4f6701c0169755eed061ce315245b40fd

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 cfc25b4cdeec396ab2b482aea16dac98
SHA1 01f78c07eae51dfd59e3d18881dd9bef53f5956d
SHA256 33eb402b82a315076bb7c1d1cb0e4e131b71f695795cd63d0cd712596c6f68df
SHA512 9ee0a5fd80ca847455a3525071a6f7187a3ba134a376823ec006c854ffa6fa8e675b98a1ad2321fe933ed942984acfde22c1555ddf3c5cb572783e3490f24c59

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 18:15

Reported

2024-06-10 18:18

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1676 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1676 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1676 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 452 wrote to memory of 3760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 452 wrote to memory of 3760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 452 wrote to memory of 3760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe

"C:\Users\Admin\AppData\Local\Temp\045bf9c313357f5b448553231fd8963cd2771c937a7f0a99d2a76d73bd2f0136.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d5c24b60af5ba7b3f7e109b3a7a8b58f
SHA1 8a91c444addcb898f6a853e8c83e7fc8070344fb
SHA256 84ad917c60bf03f19ea440d8bb730f189d2dfebfb4cf9e91e9b3ca27cff6236d
SHA512 9f4c0b591bfb9c6086ee92cf8a2a74d9ac9ad634227aa5e479fb546fca4731f58a9381c85b11c34d7752d80908fc38b3c726a2efe0f7554bfe78c22f9f980e89

C:\Windows\SysWOW64\omsecor.exe

MD5 7a3917501eec59dee101b5358beb0420
SHA1 96bc8e69e6e1f0d124052d0e462f80553209e476
SHA256 90c3c57674bb76471c59ca767de6f164af49718f2916524f9a0fd6a80e7f8084
SHA512 84a3c0f9b64bb0c7461896eaa31b5228c7ed0a5a585291164d1c74bc742a69b0f68768cbbcbe8f147247a340c4dbf93a6cf828ee954e517668ace7d5c59bce9f

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 55f3b2de8511cb79b177c64bf1010fd0
SHA1 b23f9efdd2724219aadb628f6fe7b4ea0654719e
SHA256 1e3aa337335631ca5b8dcacd2408fe68a615e9407edefe5896fb9d16077e4b6e
SHA512 ec105403d48bd39f9cd780155759d168caeb8ea12bc7f19d9890aff74f74af9f510dc0784b36a385ed1d727d1e4fa5ba14844c207c060f4ff8fb3dd01bbb4b0b