Malware Analysis Report

2024-09-11 08:31

Sample ID 240615-abpflavhpj
Target 99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c
SHA256 99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c

Threat Level: Known bad

The file 99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

Neconyd family

Neconyd

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 00:02

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 00:02

Reported

2024-06-15 00:05

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2296 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2296 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2296 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2296 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2792 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2792 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2792 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2792 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1436 wrote to memory of 1176 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1436 wrote to memory of 1176 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1436 wrote to memory of 1176 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1436 wrote to memory of 1176 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe

"C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/2296-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7848140f0f10423153665033a29bd93e
SHA1 b3056185d70db57195a31f30412d6b4292e98d07
SHA256 635b8dd319ba05b46362052077a814672123344ac62e4a9c06fbf53ed6dd5931
SHA512 4b6536b712badfab5ee5efe1ae4684c1f04fb0022aca5e537ec7a1dd5d9ee4e5c4ae7531e4b8116e9b559cfb33055995b4a7b73f4489ac02fc747bf036f02ebe

memory/2296-9-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-17-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-20-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 67c76418a44918730fe07308ed1cc3d4
SHA1 691c0eaa51cef4232b012fa61a9248449687638e
SHA256 2d30e3bb233b58a0045ee1e8b489194785d1ac192cdf65c151a03db79321128d
SHA512 4313c0ca6defcb3f92ed5d30452c433b46f7b13b44c646050f7f39197d5587cede8c9b58198a3e970110af5358505ec6ca912305a5d55ad17516fd32a6e44140

memory/1436-32-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2792-30-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ca1addfc37533b4552164b7af6cd8448
SHA1 c44d10eb2f39ad8946095ae012ece36b5ffe19e2
SHA256 917161985da04e0dfcaeaf058fadbb2aa3b5c5ce6a279080810f4c70edcff22d
SHA512 d80b42e9e48d0461a714c71487e5c3f81dcb4f9b7afcbe0a0cb3024dbdb551347e9fa28a0591f3b0b084a541ad380f5200fc310e4b3e20b54c26dc505d317040

memory/1436-42-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1176-44-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1176-46-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1176-48-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1176-50-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 00:02

Reported

2024-06-15 00:05

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1496 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1496 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1072 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1072 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1072 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe

"C:\Users\Admin\AppData\Local\Temp\99c4824f49843b605e878f22e6677d0ce98341c18561d82faef278f9203a8f3c.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7848140f0f10423153665033a29bd93e
SHA1 b3056185d70db57195a31f30412d6b4292e98d07
SHA256 635b8dd319ba05b46362052077a814672123344ac62e4a9c06fbf53ed6dd5931
SHA512 4b6536b712badfab5ee5efe1ae4684c1f04fb0022aca5e537ec7a1dd5d9ee4e5c4ae7531e4b8116e9b559cfb33055995b4a7b73f4489ac02fc747bf036f02ebe

memory/1496-2-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1072-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1072-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1072-9-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1072-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1072-12-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 cbc293697ff47a9a83137582a0c5f3be
SHA1 aa4ae8c3bfcbe7b090264c6c50a46341fe0b6ac8
SHA256 6c4caf67e5dbde51fbf432409a56bed5018284175e4655b7eb956cf4911798e2
SHA512 40054215e6414c32bce731bb40262cdd5c2a44fe69d45ba37edff05de4b5bc0eb67f4d50cc99fc232483db4f7ef95542cbf14e69dea8d1aace24764defdfc2ff

memory/1072-18-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3912-19-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3912-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3912-22-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3912-24-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3912-26-0x0000000000400000-0x000000000042D000-memory.dmp