Malware Analysis Report

2024-09-11 08:20

Sample ID 240617-a4zr2azhlq
Target a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88
SHA256 a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88

Threat Level: Known bad

The file a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88 was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

UPX dump on OEP (original entry point)

Neconyd

Neconyd family

UPX dump on OEP (original entry point)

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 00:46

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 00:46

Reported

2024-06-17 00:49

Platform

win7-20240611-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3032 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3032 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3032 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2140 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2140 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2140 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1644 wrote to memory of 2440 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1644 wrote to memory of 2440 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1644 wrote to memory of 2440 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1644 wrote to memory of 2440 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe

"C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0ffeca2c55dfad10f5d7de67b495fd22
SHA1 08de953222c2daecda66b558dc5f8230db4850f0
SHA256 7f07482e22db6de686fc90f723015308008752f5f3582e153865766b2ab1acb3
SHA512 7b1c74219cea1bf91639fbed9ea634aeb1cc66dd9caaa3a412bd1488eed6e0ab5a0deca65162999ff46d847527253b2d894eca6031dba461e4a046880b320f5b

memory/2140-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3032-11-0x00000000001B0000-0x00000000001DD000-memory.dmp

memory/3032-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3032-4-0x00000000001B0000-0x00000000001DD000-memory.dmp

memory/3032-0-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2140-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2140-18-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2140-21-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2140-24-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 dfdb1feb1f41ba03241baf8e7a8a557f
SHA1 5fb90b5d7e6c5f1518ca706780d9e7a324e07322
SHA256 faaadd7566cf9acffdabc4ce2d60bf0cb8f895ce5b0d06544dde09a4b7416800
SHA512 aaaf8b27b09b89c48fb7c2bee3e371415c54bf3ac5d0c6b7f956e3621fca8040e8a08346115c1aba8d34187dd240ef5f79ce6fcd12afd60c62f14628d33e399c

memory/2140-27-0x0000000000280000-0x00000000002AD000-memory.dmp

memory/2140-34-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1644-36-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 592fb5da688af9f8daa3c0a56932db45
SHA1 077a82b32a35c9333a88b98adeed9288ac2893c7
SHA256 199a3bf60d9d98a596c12da4c4ca5a4d0a05e3c8caaa49707c10479eb3a56182
SHA512 13eda2a905dc5bf8484b17dd6a3a6e1fa8e80a5da3b01399d8b90673fc13fa4aec50048a4bbf0eeeeb5a4557b519e1781b1cdbe6def4c50f9877f635002be208

memory/2440-48-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1644-46-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2440-50-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2440-53-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 00:46

Reported

2024-06-17 00:49

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 372 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 372 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 372 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2944 wrote to memory of 612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2944 wrote to memory of 612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe

"C:\Users\Admin\AppData\Local\Temp\a862496bff7deb7c9d385360602fb689fe8ff647f35a93171115c173bbc7da88.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/372-1-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0ffeca2c55dfad10f5d7de67b495fd22
SHA1 08de953222c2daecda66b558dc5f8230db4850f0
SHA256 7f07482e22db6de686fc90f723015308008752f5f3582e153865766b2ab1acb3
SHA512 7b1c74219cea1bf91639fbed9ea634aeb1cc66dd9caaa3a412bd1488eed6e0ab5a0deca65162999ff46d847527253b2d894eca6031dba461e4a046880b320f5b

memory/372-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-5-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-13-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 9d66c99113717dde6a0d923d5e6cb61f
SHA1 56f625ba36cde2fc794bc3c6e308d313ba160f37
SHA256 e4800b4ea07ae93714ae3442776e486c1ba787d616128374ba678b782f93175f
SHA512 dce4e17aae90bf303697ffc0b510d63609e5029ace253327c17ce8fc52f05097cf1a458f7ff5a91488850028cae34a34f736e55a1caec761073835e7f9fd9a82

memory/612-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2944-19-0x0000000000400000-0x000000000042D000-memory.dmp

memory/612-21-0x0000000000400000-0x000000000042D000-memory.dmp

memory/612-23-0x0000000000400000-0x000000000042D000-memory.dmp

memory/612-25-0x0000000000400000-0x000000000042D000-memory.dmp

memory/612-27-0x0000000000400000-0x000000000042D000-memory.dmp