Malware Analysis Report

2024-09-11 08:18

Sample ID 240615-cmb1rawbna
Target cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033
SHA256 cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033

Threat Level: Known bad

The file cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033 was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

UPX dump on OEP (original entry point)

Neconyd family

Neconyd

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 02:11

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 02:11

Reported

2024-06-15 02:13

Platform

win7-20240220-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2928 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1624 wrote to memory of 1584 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1584 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1584 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1584 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe

"C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2916-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 27adc50b2ffa7681a396050bf073673e
SHA1 a11250cf2739741853e2a41e6fad579181897809
SHA256 f262bf673ad498e1be66c25bcb8247cadec458a54e1db998cf4d265fac4e6217
SHA512 18cb09a1d918795e1137526bfe12acb32f67024046a88ac80d167ecc7f0638fb20dc8f9935dd5a08bfbcc59b86ea5412ab7ed91d4149adf495e7cd343d405e88

memory/2928-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2916-9-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2928-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2928-16-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2928-19-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2928-22-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 1aaa1bd74ca7c5f4265e75561cdb40b6
SHA1 24ef9ebebf3b528d40084d6889dfaa517875e764
SHA256 29898815a33b519abbf590b65f9d5f40d0156af6a0380199a074a75c13104548
SHA512 ebbd8ed56d0be2011769cbefb6a2b97e3c4758299f9630b5fa98aaadba7b49b8fd6394636c1ca38d6c88c9b010bd7fef8f17c0b7c04e3f27e37152ba3176f957

memory/2928-26-0x0000000000480000-0x00000000004AD000-memory.dmp

memory/2928-32-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7a7ee8499f080cf560d299a72f837ef2
SHA1 7e6a8e2d46603890938d776de306dbd0e2109b28
SHA256 3684f513878b0ac948e3287ffb6e6a55e424e2df69aed57890369980760b319a
SHA512 2f574840e1840aae1240c14d56bca5435096369990436e570d0546d1954142b40ebb941560d03182651d521cbb6ac89e20782fb773a4f73f03a34d9367b91712

memory/1624-43-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1584-45-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1584-47-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1584-50-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 02:11

Reported

2024-06-15 02:13

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2388 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3224 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3224 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3224 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe

"C:\Users\Admin\AppData\Local\Temp\cc85b0344a1ff213a9d72d92d87c5a241e918742ec0b3f9b87a255cfbeb62033.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2388-1-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 27adc50b2ffa7681a396050bf073673e
SHA1 a11250cf2739741853e2a41e6fad579181897809
SHA256 f262bf673ad498e1be66c25bcb8247cadec458a54e1db998cf4d265fac4e6217
SHA512 18cb09a1d918795e1137526bfe12acb32f67024046a88ac80d167ecc7f0638fb20dc8f9935dd5a08bfbcc59b86ea5412ab7ed91d4149adf495e7cd343d405e88

memory/2388-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3224-21-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 6cc25d853a4931a988fc1ad9619685c2
SHA1 57f9e2a07a8c446baa1e6ac81c766a5ae8ec8261
SHA256 44d407c6ea8025eefd031a41f139c86981499b92faa0151be8b178cb1a4822a4
SHA512 6e9d402cb454eedf2e85926474bb9b1de7024973e0d83a786b54bc9468d62610d672291ad0807e10ba69cfae8037434c3d9f6b9e5f114e36c457c07acf280def

memory/1084-22-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1084-23-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1084-26-0x0000000000400000-0x000000000042D000-memory.dmp