Malware Analysis Report

2024-09-11 08:40

Sample ID 240614-a4ef4ayalh
Target 81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39
SHA256 81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39

Threat Level: Known bad

The file 81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:45

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:45

Reported

2024-06-14 00:48

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2980 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1452 wrote to memory of 1592 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1452 wrote to memory of 1592 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1452 wrote to memory of 1592 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1452 wrote to memory of 1592 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe

"C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 01a7654fed142c16ffa91acc16138a61
SHA1 a3c55e468dbbced29582f9001b12d23ebf8c29f6
SHA256 b208e06bd024111a8a1fa851030fbde42627221da3d2464d0a97202817c7765a
SHA512 181f5a472267191dbb3a8a4e2a6d9cd9778e8c8e432ef1961bdf993de0df8f75ea4bd65ba70a9f28a80246edbd052b5658e1b55bb7016f5017da38dc165615d4

\Windows\SysWOW64\omsecor.exe

MD5 51b6366c559641397f353bf60a98c3d1
SHA1 0e2c1f8d2f2632cf452351659add6ac86f9dbc43
SHA256 814b680b0befbce0d0168265f3bb71b24d4b3358ccffda1c6c9f8bdb8cfb4d07
SHA512 08b966356fbc454e4eef6f4cab934a92d881bd357d562805be6b8303df62a0d68813644e5f431adb55003d7a5efb692d109f3201387d41644610df2472cc9b6e

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d12afe6ec081742a4e979adfda6a668b
SHA1 b520c1cb17b264c2d3362e9f0e3cb7bdf040757f
SHA256 9856643e97979ba6c24b182a870b2140bc16dce01f4ef9ff67fd9b0128500223
SHA512 ddeff650f9ac7c4b32ec3248882033db3b55f32eca18752d9f9231af48cd9aac030d38b73db38b6f34f5278eaf2473bf5d7be4808fcdc962a451177835b995e2

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:45

Reported

2024-06-14 00:48

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1360 wrote to memory of 932 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1360 wrote to memory of 932 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1360 wrote to memory of 932 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 932 wrote to memory of 5104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 5104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 5104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe

"C:\Users\Admin\AppData\Local\Temp\81927933204b888c01cbaf8c0d9dddf3947ae1cfeeeccabf62c12bea82f45e39.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 01a7654fed142c16ffa91acc16138a61
SHA1 a3c55e468dbbced29582f9001b12d23ebf8c29f6
SHA256 b208e06bd024111a8a1fa851030fbde42627221da3d2464d0a97202817c7765a
SHA512 181f5a472267191dbb3a8a4e2a6d9cd9778e8c8e432ef1961bdf993de0df8f75ea4bd65ba70a9f28a80246edbd052b5658e1b55bb7016f5017da38dc165615d4

C:\Windows\SysWOW64\omsecor.exe

MD5 6c7c98877ed760127a427e82480fe8bc
SHA1 f9a8f328c246bcb1022955685c661d1a7073296b
SHA256 bb9e2ba47abc6d808071aad9cb7f55c0d928e6421895237aca566f0871a6910e
SHA512 b48c4b79780e98aff5912cb46fab9a41c58514bbbd1da57669a14ef34e888d244313e3f9466b2d0019fd411242ec181a21f966ce7b98c804f53078cafcb95888

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6519948afca9632929bb578f0ced2f7f
SHA1 cb6d78afcd7e297d942f8aa2112b1208f7b3781f
SHA256 96c1d8562b15559e03336081a4df7b41570bf0f0f7cda70ab551eec8674c8d22
SHA512 bf80e24e1aab0f10623bc0be91323b5d811efd175f47c1b229a622a194d615301c51485424899ec20d9b0346941fc0288f5a685acc2ac8a59f11125c0e86d539