Malware Analysis Report

2024-09-11 08:32

Sample ID 240612-hdadfsshnf
Target eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571
SHA256 eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571

Threat Level: Known bad

The file eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 06:36

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 06:36

Reported

2024-06-12 06:39

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1912 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2576 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2576 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2576 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2576 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1612 wrote to memory of 1556 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1612 wrote to memory of 1556 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1612 wrote to memory of 1556 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1612 wrote to memory of 1556 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe

"C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1912-1-0x0000000000400000-0x000000000042B000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 9048bd94c55901e77070f475f417fdaf
SHA1 1d6d2d1cc51ee19afd157b0741e25e0ab79c852b
SHA256 9e060c03ee30f8cc4e5c0a67f772d992349b3f9113a599983f623fe6811eb627
SHA512 9f1beb8974dfd3f2e0ba1f1cc05d7779ab31f861f7610634edade75cedc727331e9c55a4ef81ca2fc2bdb0633c6a62e1a291761269037280122600dfd52bf7be

memory/2576-10-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1912-11-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1912-9-0x00000000002B0000-0x00000000002DB000-memory.dmp

memory/2576-13-0x0000000000400000-0x000000000042B000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 9e1e7f622f9ab22999ec0c0096e67f60
SHA1 4fe3dfa063c8fcf221524d5b82370d6d03e07381
SHA256 f2436b78d1d0e3be83ca982e4c0e034dcd105d851320a5b727781a6e331b396f
SHA512 189860bfb2190b0a183c077b8bfe3f4a76dcef4f66c725e84eb4c59820b9bb6dca16ab64db483c5541c24c77b7fa6329e0370b7083dc1b771a8283101180b5e0

memory/2576-18-0x0000000000320000-0x000000000034B000-memory.dmp

memory/1612-28-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2576-24-0x0000000000400000-0x000000000042B000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0be627aa6154d62bea7554d0b6facd6e
SHA1 535fd1fff1cc0a2c948467ec964a1d93dc527204
SHA256 2f074548d20b267e3e98df5441a014554e427932879b33f969f562c6f1a1d62e
SHA512 66dc32b3bcd6431d964b38a1c63a3dc65bf59d3b463a2ea1332ef99c266b60996ca839e8d1a000b98641ef6becfdca60040e21d1ea04a4a8801a1b365394a1a9

memory/1612-35-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1556-37-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1556-39-0x0000000000400000-0x000000000042B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 06:36

Reported

2024-06-12 06:39

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2828 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2828 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4912 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4912 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4912 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4144 wrote to memory of 1020 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 1020 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 1020 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe

"C:\Users\Admin\AppData\Local\Temp\eea2dc8ffb7ae1e66174b9b2db0c98fe5a5f0c8c773c783cb4cafc2ad94d0571.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/2828-1-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 9048bd94c55901e77070f475f417fdaf
SHA1 1d6d2d1cc51ee19afd157b0741e25e0ab79c852b
SHA256 9e060c03ee30f8cc4e5c0a67f772d992349b3f9113a599983f623fe6811eb627
SHA512 9f1beb8974dfd3f2e0ba1f1cc05d7779ab31f861f7610634edade75cedc727331e9c55a4ef81ca2fc2bdb0633c6a62e1a291761269037280122600dfd52bf7be

memory/2828-5-0x0000000000400000-0x000000000042B000-memory.dmp

memory/4912-6-0x0000000000400000-0x000000000042B000-memory.dmp

memory/4912-7-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 f2f7ba9b118f8ea0a7ec8e10c648d849
SHA1 83d997b235982d2d64aadca21744bd3fb1a2b892
SHA256 6a951637b1fd8bd4ffe42fc82dab63d632f0d02b3abb38e7052354eb85b6b326
SHA512 280df3619705a97e2223e56160ec659135887184746919682c0c8ec5dc373838f3774f638e477d83f86ce9e1a23e7af2d40b625cbd65eee47d41e3e43d9ca586

memory/4912-12-0x0000000000400000-0x000000000042B000-memory.dmp

memory/4144-13-0x0000000000400000-0x000000000042B000-memory.dmp

memory/4144-17-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4156a46c237900853691b1cfc3ab58cd
SHA1 9ecea5feaac044f221e9e3d954c680d11a69cd59
SHA256 1159f8894350e735e75a69255e284f09257e3690a424e1d513273dc1d31ce3e8
SHA512 db420d2e61326a4a42d2378439297c142fdf014955746b2002535b894f3e519db913a1a5c8e59f741aca7e8902e01c6c7121e363f8d473f8c2b4d41c89b6c872

memory/1020-18-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1020-20-0x0000000000400000-0x000000000042B000-memory.dmp