Malware Analysis Report

2024-09-11 08:39

Sample ID 240611-ewse7stfme
Target e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237
SHA256 e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237

Threat Level: Known bad

The file e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 04:17

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 04:17

Reported

2024-06-11 04:20

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1232 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1232 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1232 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2120 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2120 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2120 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2120 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 1320 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1032 wrote to memory of 1320 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1032 wrote to memory of 1320 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1032 wrote to memory of 1320 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe

"C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 011b869df0df8533839d063334d161af
SHA1 7da737184c21d0d6285f41d06ff4839002efdb60
SHA256 6a1c0c4a72038ee79b20f5b7ed58a6ea23038cbb2b296a8ba77e89ec0e0644d2
SHA512 3b4fddca53edf0413553282373321aa2b71fb108856f4d7bc9a7f6a02a29125490ff219c7210c7742813d82f8b25089c5e0ca3f41f22316e2244990967a9910a

\Windows\SysWOW64\omsecor.exe

MD5 9ab4cb27589571752a73b2fcebb3abb3
SHA1 e63da3815c22f9b1cf28e62d268e981ddceb1464
SHA256 c9a50bb2a92f55efcad4b80dcbf0844351b7136384e8dd47b0f0cdddcc6c2467
SHA512 727d721e683992c8bef35e51fdbfa0bfa7a65251748d9f272f986ae82fa4d4cd491491919be97687732c7c3e276415882ea9128b8ef282733822c1d37859ffc4

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fee05aa2fead494f2292ad3edc4d423a
SHA1 da19f7b3842c952a5ed29c8b0167deb789833340
SHA256 0d551576de2c8833d5a2631cc6237cbecf2a466420b27030b43009281eebc928
SHA512 8eeb1cdc0aec9a7e70dd8899d5b9ec5ec09cc3556172981dc02ecd7598057d20d9f0a83cd912dc708637dbdb3f22b0f5234552ddd65c58b4c7bac6792fb8cf2d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 04:17

Reported

2024-06-11 04:20

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4804 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4804 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4804 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4172 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4172 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4172 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2812 wrote to memory of 2780 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2812 wrote to memory of 2780 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2812 wrote to memory of 2780 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe

"C:\Users\Admin\AppData\Local\Temp\e322c44cf78e54bc43705b31adf51210746f1655e706b897a0ab33d9cf896237.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 011b869df0df8533839d063334d161af
SHA1 7da737184c21d0d6285f41d06ff4839002efdb60
SHA256 6a1c0c4a72038ee79b20f5b7ed58a6ea23038cbb2b296a8ba77e89ec0e0644d2
SHA512 3b4fddca53edf0413553282373321aa2b71fb108856f4d7bc9a7f6a02a29125490ff219c7210c7742813d82f8b25089c5e0ca3f41f22316e2244990967a9910a

C:\Windows\SysWOW64\omsecor.exe

MD5 b65b79ccbb9dcb36587f4c7a877194b4
SHA1 af32e174851a0a3f8f2dc0ec928bfc6b4be71788
SHA256 eeb96e7400966bb6ea0a34a954baef89af8e3a4c16155aeb83c2fcc148ff9c24
SHA512 b4abef18f38eefdbfa21a9132ebaa2de084a2f145dcbb572235c55a2b7556a9495ddbb8717c86c217ff4840968135bbd624bb794a831f6c28ea5bcdce9b354ac

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6bcb9e281533dcf4af22a8b8e462b32c
SHA1 9fa418f4e4b9e84a482374e28c9a792e8469bf63
SHA256 48fb3c1636771aa10e111022c6c896cfb83af684b736ed0eb1f2c0c9eaa1650e
SHA512 04d98031b9bed1ff1ec61532ead6d847f603d33342a20cf17a8bc32d5f1e71116b8d656d19b1b83c86c8d8c5f63049715a3f99d7bde525d52d45bd3b81a7c97e