Malware Analysis Report

2024-09-11 08:32

Sample ID 240612-ecqghazfng
Target c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107
SHA256 c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107

Threat Level: Known bad

The file c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 03:47

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 03:47

Reported

2024-06-12 03:50

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2996 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2176 wrote to memory of 1940 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2176 wrote to memory of 1940 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2176 wrote to memory of 1940 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2176 wrote to memory of 1940 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe

"C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c8faf20376ad9af68cce1f739a371cbc
SHA1 dc2aa2a92a7943307fdb02245527557ec5fab204
SHA256 ec5e68af7135686ce237d9565808c2910da96aaae44a07668eb48095d7fca04e
SHA512 87ac5fd33759426a4dc6f633e8ede2dd8cd8426a997409a8c8fd7acda6389bd78a71a2a7cbee8df13be4fac842d96c0e2608324baf57a48b4b9e7365fe0a614c

\Windows\SysWOW64\omsecor.exe

MD5 eb4ad7f5bad2f7b2c3a2bfd389af8e9f
SHA1 149ee8bd129dc062e15be6e058423dd112681da5
SHA256 e3479c349b406bbd8e2c28ce3193cc54db996ada43dbc00a9bfe7ffad238c3ee
SHA512 308d2d4e265bbb353c897750fb4ee647a48249037e665bffd2e005c16a92b475d1958fece3c7ebe039e674febb2f7bffb04cd23c049f2c27407527b02b67e69e

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 51f1fa1ee9d8c05c76a43ff95188baec
SHA1 5391cb90597b3db0b358e62b6ab5df55099270e7
SHA256 822f2a0a87053150732b7e20eb7e109163576c36f8eb0ef971b00ca395fdc510
SHA512 8aa73e3abab3fe49951fcc2ba1b2979416847003a9b33b84d4fb38c304d5597618883ab4c38e5f6e881acbb22f5d6375029b6bc76e905c5bcf976b579277c849

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 03:47

Reported

2024-06-12 03:50

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 228 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 228 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5008 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5008 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5008 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe

"C:\Users\Admin\AppData\Local\Temp\c06f4296ebc785e91ad40f87a0b9209a884f572df45897539c88a016e050a107.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c8faf20376ad9af68cce1f739a371cbc
SHA1 dc2aa2a92a7943307fdb02245527557ec5fab204
SHA256 ec5e68af7135686ce237d9565808c2910da96aaae44a07668eb48095d7fca04e
SHA512 87ac5fd33759426a4dc6f633e8ede2dd8cd8426a997409a8c8fd7acda6389bd78a71a2a7cbee8df13be4fac842d96c0e2608324baf57a48b4b9e7365fe0a614c

C:\Windows\SysWOW64\omsecor.exe

MD5 51a01878a910638692986116675a4213
SHA1 714080d959fb36408f37ec7802fb65b5d64ad4ab
SHA256 a67c4287954881e37b32b4df49b6cbcc3b69f55704a3bdbed610f7a5f4770123
SHA512 e7744cdc877d70d9f8bddc05edabeb351fc1627db67c12b7fb3db31a612979f1fab6c699a755c00d55b0759499571f2fa579dda1491def103561711d683e5267