Malware Analysis Report

2024-09-11 08:38

Sample ID 240611-flqpasvfma
Target f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254
SHA256 f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254

Threat Level: Known bad

The file f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 04:57

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 04:57

Reported

2024-06-11 05:00

Platform

win7-20240221-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1460 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1460 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1460 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1460 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2008 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2008 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2008 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe

"C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5dc9711376e561d567606c1a76b77102
SHA1 55ea92127b6dc48ebcacad6edb7a0ea1e216fa61
SHA256 1181d4c2596609006df55a91d4352a59b978629b12678ec50c8f19b625ee0346
SHA512 2994cb1df2b9eb9623e070f877e32aa1711a39558a6490e3d2007288cffdbe34bbe7f5d4a26044d239cfd5894377534e29c595e6594bafe92c1da0f995b80a2e

\Windows\SysWOW64\omsecor.exe

MD5 4d6000112b486393cc0af8387f390e3e
SHA1 778a5a3a83c6db518a2c0cecdb0f649e3504f3cc
SHA256 beed99df260d4580293154d17ae3180a995736de48452c589aabb2da3d240b82
SHA512 3d50e320f2d9fbef40519328bf9ddfe3626919e3e2d3746106c9ab4a8afc0bd7f5dd0d8a8a72f2ab23e0c155c71891bfbced48bd69f1ed758db5c5b41677e815

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7bbdaf6ca093e37e7fab6f6a9fe2de09
SHA1 871fa53e86cbd914ea805afa4f422cb32cc046ee
SHA256 5df2a3757a44b4930cba4bd17532bf836ebb3e26112822b430b716a87e244177
SHA512 8931d0c5a636aa1e9f6eade53c53daa0e3aeba258d455523651ebb57e32278ced8b146f21dd81430d6dc00b4e7fb714b055ec281009dfad2bf47ae4f42c05629

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 04:57

Reported

2024-06-11 05:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 116 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 116 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5064 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4720 wrote to memory of 3616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4720 wrote to memory of 3616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4720 wrote to memory of 3616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe

"C:\Users\Admin\AppData\Local\Temp\f1eadd6ef7e9e69a85fae1c358209a067a3196ef69cf5f2001beaabf33bf2254.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5dc9711376e561d567606c1a76b77102
SHA1 55ea92127b6dc48ebcacad6edb7a0ea1e216fa61
SHA256 1181d4c2596609006df55a91d4352a59b978629b12678ec50c8f19b625ee0346
SHA512 2994cb1df2b9eb9623e070f877e32aa1711a39558a6490e3d2007288cffdbe34bbe7f5d4a26044d239cfd5894377534e29c595e6594bafe92c1da0f995b80a2e

C:\Windows\SysWOW64\omsecor.exe

MD5 b9d717bbf07f39d9343c600862a956a3
SHA1 98c82f22bcaf1c5376ddba9a3dc037f6efbb05fb
SHA256 f12cffdb65aee832dc442dd7631782cb91fb2b31146b24d1f1faaf4695cea37d
SHA512 1329da697194d72e37a31a66730ce4b5f32ec2284590a666076fa0a3be31d3adf6c1fe483db6d6082a54a631c94934b0940df8a04c35c1c6db3de60ea7331099

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b08350172b144a02d7d16047dc2dc626
SHA1 465da4ffc7edd3d764c055c6ae00e0095a90f1eb
SHA256 69595f8a02ec36c75f28dfba78d53b6ff7a626f9a327d19ea456a23be698f5c6
SHA512 a618964a5d78503dc42449264a37dbb5bd652edaef95656394ccb58ea792e763f2e7f979b2446bca749d7d8e4745d70b04c417910772067b850d85de80ace05a