Malware Analysis Report

2024-09-11 08:32

Sample ID 240612-gp3cyasejg
Target e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05
SHA256 e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05

Threat Level: Known bad

The file e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 05:59

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 05:59

Reported

2024-06-12 06:02

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1264 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1264 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1264 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1264 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe

"C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2156-1-0x0000000000400000-0x000000000042A000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 631d8268c92c9a5f0c4f49faca87d688
SHA1 8b669d7b38bb36b150b2223e9d057bbc99b2e780
SHA256 df506c76067d33660f20aeab742eafe1c4b6009118b3e0a20328d24319fdc520
SHA512 5dc687f60c398b9107e8ba1eb606de4c56dbb52efca82b2ad7408cc0028d11bc803e30ca28ebfd9d61a44a768ec9fe252ef838c4253419943a17bf22badc33fb

memory/1264-9-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1264-11-0x0000000000400000-0x000000000042A000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 10db817a5851584d976c6e972d6dd0bc
SHA1 9c3ea3536b6e9ec6a4598a1dfb49d8dcd6a711d5
SHA256 c7a926367fbeec8af31902096499927eab458fdd90e36d699c6a9e6b02328dab
SHA512 01ab466ee8d6807073b992aface434d628c699c32e5716d03064a89b21afe183e1b845addaaf7b832abe1a145b1cfc3124c3013cd158ab9e296d8a14630565c0

memory/1264-16-0x0000000000280000-0x00000000002AA000-memory.dmp

memory/1264-22-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2420-25-0x0000000000400000-0x000000000042A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 05:59

Reported

2024-06-12 06:02

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5008 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5008 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5008 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2780 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2780 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2780 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 1804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 1804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 1804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe

"C:\Users\Admin\AppData\Local\Temp\e9a8f9872ef43f02aeb35ac92e0aeac5e8e58aa46e8215e72bcac3026f7c1c05.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/5008-1-0x0000000000400000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 631d8268c92c9a5f0c4f49faca87d688
SHA1 8b669d7b38bb36b150b2223e9d057bbc99b2e780
SHA256 df506c76067d33660f20aeab742eafe1c4b6009118b3e0a20328d24319fdc520
SHA512 5dc687f60c398b9107e8ba1eb606de4c56dbb52efca82b2ad7408cc0028d11bc803e30ca28ebfd9d61a44a768ec9fe252ef838c4253419943a17bf22badc33fb

memory/2780-5-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2780-6-0x0000000000400000-0x000000000042A000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 68e249d52ed07579bd30660f29c8a4c8
SHA1 d777fb05530410d74151afb28478c1a4e2eecd36
SHA256 b349ad66680d603f6efe334ca05deccb5716a51f760db1b65a7d389bcdb9aa98
SHA512 3c06a86148e1cf8c422a4a318a3f0f820e0e27534ebd7a0f55d3e056e86377e0a12dcec181f026a56984ae8f4c15a2e7214f35450023f5f460778c73ff06c252

memory/2780-10-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2724-11-0x0000000000400000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 271d78310d3b18dc676b674a329f44e8
SHA1 472fa5573714d982cf760b64b2209947c8a68fbb
SHA256 70b8fab6cfeda5f39049a67436803198427c61c18a96d94b82b694a0686f1a6f
SHA512 a72e528b8c789d3661fd049b69299355d94390923e667e2dae128d28c7e374940891bc4730ccf500500da2fe9a0d74037a04fb63c6c165e21ac86892e5a68f93

memory/2724-15-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1804-17-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1804-19-0x0000000000400000-0x000000000042A000-memory.dmp