Malware Analysis Report

2024-09-11 08:39

Sample ID 240611-dkfrla1hrg
Target c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd
SHA256 c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd

Threat Level: Known bad

The file c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 03:03

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 03:03

Reported

2024-06-11 03:06

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2424 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2424 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2424 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2424 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2188 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2188 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2188 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2188 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 756 wrote to memory of 1260 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 1260 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 1260 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 1260 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe

"C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 dd04900196fefc12eb5ba95e9bc14ab5
SHA1 8df2e811884ade3e1abecb896ae6d14a34e18ece
SHA256 437678bb23ae00a10202b4bbdd886fa7eeffde93e13f28a18245dbe2d30eece6
SHA512 942765b88b015baf184cb2e05fc6a34ce1e468f8a051c40818b6c580f9061aefc9f6449558bb17a79410de9b3539d26e3cc60514182ff6d00221a14b7d415dc0

\Windows\SysWOW64\omsecor.exe

MD5 b31387ba86fcd7321fb6ec46a46a3ceb
SHA1 49b61d93649b03049df5edf9cce4db39a2da04be
SHA256 df7669663311bc65aee3d902f6b8138df61dea0e3981dff39b6e9fe536a77c74
SHA512 4af8893c3748cadf3e0205f3a53f9fc025bb13b9cdad8a50e3a6f36a4f6209862eb6f029a5cd8ec5f86a9cf6acdab6d96c26fc6f1d96248dfd6ec15714cc96a7

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 76776530eed8cc1566805224cd3975b9
SHA1 9d695c34b7130ae1411c2719c60ed0e2cff2b30c
SHA256 294666a38cb7cf3b6ec2dde235d26831dd23782079b63010135140182728f412
SHA512 e94d8ea16bf0b57a83cdab11cfb6d4ddb72a78578c08834d86b0072ba19e352cb47894249762fb962e2b17d41b6b89442fd40b5c48dada2790e611c9442b350d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 03:03

Reported

2024-06-11 03:06

Platform

win10v2004-20240226-en

Max time kernel

93s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 372 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 372 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 372 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5028 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5028 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5028 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe

"C:\Users\Admin\AppData\Local\Temp\c7e911f5e84d6cc59bbf7cc5c1dc030c62e5f710bc049b354c016bd20c7957cd.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 192.98.74.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 dd04900196fefc12eb5ba95e9bc14ab5
SHA1 8df2e811884ade3e1abecb896ae6d14a34e18ece
SHA256 437678bb23ae00a10202b4bbdd886fa7eeffde93e13f28a18245dbe2d30eece6
SHA512 942765b88b015baf184cb2e05fc6a34ce1e468f8a051c40818b6c580f9061aefc9f6449558bb17a79410de9b3539d26e3cc60514182ff6d00221a14b7d415dc0

C:\Windows\SysWOW64\omsecor.exe

MD5 178580c2899ba1e5afe148545453326e
SHA1 4d7dab6408aa3203ff61ea4cdd59d8311a162049
SHA256 d3d0919b579322fe564fe7316751575c5b56fb5a4f80646618a5151993fb0c9c
SHA512 f58743e8c06ef3e3caf8016f13b975e0a6c8fc3b21af4953a024b8aa20fd98b25b277766c11ffceb5fd66c503003ec29bba413f8139cf721fa125902beff7dd8