Malware Analysis Report

2024-09-11 08:26

Sample ID 240617-bwgrxsxhqg
Target b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f
SHA256 b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f
Tags
neconyd trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f

Threat Level: Known bad

The file b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f was found to be: Known bad.

Malicious Activity Summary

neconyd trojan upx

UPX dump on OEP (original entry point)

Neconyd

Neconyd family

UPX dump on OEP (original entry point)

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 01:29

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 01:29

Reported

2024-06-17 01:32

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3848 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3848 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3848 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3420 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3420 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3420 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe

"C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3848-0-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 97aa3594884ae32e74b267b8106107f2
SHA1 57ac394cfa2fded80de795299fbfac937ebf0a77
SHA256 e067645250b5adc00f5975f5bd10e235134f80a4a6412f0073208c053c11a2f5
SHA512 17320f5cb5045ef56120b2d8aac29582e543c8de9b7f58942087b7cbbd49f18c800e78d24c0c3e8dd49f4dea3c646b14c9327ca734d8287d1e3e31847aefdd27

memory/3848-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-5-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3420-21-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 b7c2528d9bec0035f141cf65c666d3f7
SHA1 d80c5208d95c67ab48520ead42b9130df62c02b2
SHA256 9131e5d6b4f7626b6e5752d9e363b51a0df0a7afc81b18e8e80442afd4e59427
SHA512 5913af830a8db756c2c221b3d114b7b5aeec15c18c2485cab978739381520970806b3be140be68795ae43e6f7bb756388a9a80f13188c8bd50194bf75dfc83e2

memory/4500-22-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4500-23-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4500-26-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 01:29

Reported

2024-06-17 01:32

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2040 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2040 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2040 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2164 wrote to memory of 1932 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2164 wrote to memory of 1932 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2164 wrote to memory of 1932 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2164 wrote to memory of 1932 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe

"C:\Users\Admin\AppData\Local\Temp\b9b8e7dca52ad0f7cf478328ee5ec8e888d5f31ade3e02b9629fa9b10b56b30f.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2040-1-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 97aa3594884ae32e74b267b8106107f2
SHA1 57ac394cfa2fded80de795299fbfac937ebf0a77
SHA256 e067645250b5adc00f5975f5bd10e235134f80a4a6412f0073208c053c11a2f5
SHA512 17320f5cb5045ef56120b2d8aac29582e543c8de9b7f58942087b7cbbd49f18c800e78d24c0c3e8dd49f4dea3c646b14c9327ca734d8287d1e3e31847aefdd27

memory/1784-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2040-8-0x0000000000220000-0x000000000024D000-memory.dmp

memory/1784-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1784-16-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1784-19-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1784-22-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 5ad47d1e8ecd860fc7f92ae0a72e6345
SHA1 f2b4ef7801cbe09846021108bdf8e7b58a1f95bd
SHA256 c15db0bc43c64d58c49a29e43ed33904ae5b5c53466ce658cd451058153011fc
SHA512 2c9d131d5cda2a3988ec7d0496cbb14488d1584ae12c51f32ba6f387f529e2a0610f0f6abf7fad1764b830c2a32c5bae7c09fceafde94c9efaf019079b8fa24b

memory/1784-25-0x0000000000790000-0x00000000007BD000-memory.dmp

memory/1784-32-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5993d8ae0788c448e0c4897447a9d88b
SHA1 5e4faa0ea9220e61098b9c824254b09a8ff9e555
SHA256 a74fb30119c623ad003f8321b83632e50d0667b126438eadc6ecabb5d0b2ed4a
SHA512 d33247695bc1e75a5ac3806d9c5f9bdb467c2afd55b22935792eca353b04e290900ccff938fe8299ac86e7e7cde699294d9c29f66962047d2efe53cf45226a6e

memory/2164-43-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1932-45-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1932-47-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1932-50-0x0000000000400000-0x000000000042D000-memory.dmp