Malware Analysis Report

2024-09-11 08:19

Sample ID 240614-yqlj9atdrf
Target 2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7
SHA256 2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7

Threat Level: Known bad

The file 2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7 was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

Neconyd family

UPX dump on OEP (original entry point)

Neconyd

UPX dump on OEP (original entry point)

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 19:59

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 19:59

Reported

2024-06-14 20:01

Platform

win7-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 3048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2240 wrote to memory of 3048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2240 wrote to memory of 3048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2240 wrote to memory of 3048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe

"C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1940-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c46d7d63d95bf61d79fd154f721af26b
SHA1 28ada29b76abf17f4647544aa5e2b8712a52c7a2
SHA256 b95acf302ac3605b6dbeace64a484f4a5128daf7bb0ba5a9d9fe194b64939bcd
SHA512 422f948b1265d422233fc490035872421a6b4fe2e6ec73ca03eb639fad60738b6b6e8963117de648ba0cd395d1e4c132a2553d83b3dab24502bcce8959098db8

memory/1940-9-0x0000000000220000-0x000000000024D000-memory.dmp

memory/1940-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1736-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1736-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1736-17-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1736-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1736-23-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 6eb19d4c0e8dc5036cb86d0af718a4fb
SHA1 eb331672e94b31a66bdc86c1a32561f1298eccc9
SHA256 3e99d81814c188dc918b85932339cb2a59fa8889c824cb1188c99c6aebd6c383
SHA512 d01f101d3585dfe2de6fe4b91f12c87039827958be75150bc66b853f9c81074643054a86dc05c84969d506d936e60570d61a36ad10e99528fff32dbd9285b936

memory/1736-26-0x0000000000430000-0x000000000045D000-memory.dmp

memory/1736-33-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 aa6e5787f2dcbb092496f53dadc6faa0
SHA1 e4b45db6b968465eaf5cb04f9e161136aedae7a4
SHA256 562abac16abbdda23f4637d36f9c53cc5c51cbd4da4d0d40ea08cae3e905161d
SHA512 cb4a0076122226834d70477530e63303ec1a55a9edfa7ade0615cc7e14474919c297628e546be558b23fad12a849c2908df0f88270692b6bffa9c280cbc53ff4

memory/2240-39-0x00000000001B0000-0x00000000001DD000-memory.dmp

memory/2240-46-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3048-47-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3048-49-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3048-52-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 19:59

Reported

2024-06-14 20:02

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4980 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4980 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4980 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4404 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4404 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4404 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe

"C:\Users\Admin\AppData\Local\Temp\2bba7f238aa1ac64645130c2614c4b2e751c0e5e15c73c4ddd45e0b78e7750e7.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 87.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/4980-0-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c46d7d63d95bf61d79fd154f721af26b
SHA1 28ada29b76abf17f4647544aa5e2b8712a52c7a2
SHA256 b95acf302ac3605b6dbeace64a484f4a5128daf7bb0ba5a9d9fe194b64939bcd
SHA512 422f948b1265d422233fc490035872421a6b4fe2e6ec73ca03eb639fad60738b6b6e8963117de648ba0cd395d1e4c132a2553d83b3dab24502bcce8959098db8

memory/4404-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4980-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4404-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4404-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4404-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4404-15-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 aac25881df71f127cbdf981279c227e7
SHA1 2ba5bbae3f8bbc3bd01b85593897d196e06c7951
SHA256 a38251209ad0fc3b382aaec85398a2d46cf62458e4cd77cc4f5dafdfc5a0ee68
SHA512 35b6139671340d34f21f918c2a10c23d23ea34bd65a8c4555fb012023ac9bfdde5e47e7a4c2172b0de8a1b8f95d1bfc4b8de6271ad94f0f9e58fa522479338c8

memory/4404-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3944-22-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3944-23-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3944-26-0x0000000000400000-0x000000000042D000-memory.dmp