Malware Analysis Report

2024-09-11 08:19

Sample ID 240618-w8tx8sycnm
Target 0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0
SHA256 0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0
Tags
upx neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0

Threat Level: Known bad

The file 0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0 was found to be: Known bad.

Malicious Activity Summary

upx neconyd trojan

Neconyd

UPX dump on OEP (original entry point)

Neconyd family

UPX dump on OEP (original entry point)

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 18:35

Signatures

Neconyd family

neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 18:35

Reported

2024-06-18 18:38

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2984 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2984 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2984 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2984 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2996 wrote to memory of 236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 236 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 236 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 236 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 236 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe

"C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/2984-1-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 27fe45d207f714812dcc923fba22272c
SHA1 fd9ca4ed39a223cf7963b5faa86058357b6febc3
SHA256 c58c4aded71e0632fef0ce8c490766bc33d300de72b85fab530c5e3cfa881ec3
SHA512 c94f3bfc8b10fc38473ef2fdca0e010e02a7987e2ea58f5605dc9f13c7e0008d3fec4928a8894bd599cfbe8ad418e31679c8ad14a6d4efa552b125d04805062c

memory/2996-12-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2984-9-0x00000000002C0000-0x00000000002ED000-memory.dmp

memory/2996-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2996-17-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2996-20-0x0000000000400000-0x000000000042D000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 0d1038b55b1a7ecf5a8ca4714758b4a1
SHA1 c1718ab0c18101fe534ddbd7066c5b500fe41ee0
SHA256 5333ef29259badf5995028ad5a6dce258efcca61e881690418a317753cfba30b
SHA512 6bb7ca64e2083a67b10c03ad30a5395d9bac2229672327b23343188dc337b1397d247635ac4ac0a33baba135aa49695a8f0aaa95f687be0f62711fe187605cdd

memory/2996-24-0x0000000000530000-0x000000000055D000-memory.dmp

memory/2996-31-0x0000000000400000-0x000000000042D000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 36d0aaa06b4f01c7e0b76312a4d4739b
SHA1 09f92547d75add8efa1cfc84e4ee13d3524ab26d
SHA256 6fe8075bec1d4c53ada30fde9753f5fd7964d09f57e9f20f884a3dabd1e719a5
SHA512 7e3740ffd72f61f40b43fc4a73fc5ca054e9b407f6fd19cf534ef7acc5082dc4b48b9d27aed255e8a0f8cdec71cc8872be1630f928446bc748cc5d00381365bb

memory/2248-45-0x0000000000400000-0x000000000042D000-memory.dmp

memory/236-42-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2248-46-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2248-48-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2248-50-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 18:35

Reported

2024-06-18 18:38

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe"

Signatures

Neconyd

trojan neconyd

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2656 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4908 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4908 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4908 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe

"C:\Users\Admin\AppData\Local\Temp\0eac0c658060c898e4f62923bc68f75451d1902622737fb32830d30ef4851fa0.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 83.121.18.2.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 27fe45d207f714812dcc923fba22272c
SHA1 fd9ca4ed39a223cf7963b5faa86058357b6febc3
SHA256 c58c4aded71e0632fef0ce8c490766bc33d300de72b85fab530c5e3cfa881ec3
SHA512 c94f3bfc8b10fc38473ef2fdca0e010e02a7987e2ea58f5605dc9f13c7e0008d3fec4928a8894bd599cfbe8ad418e31679c8ad14a6d4efa552b125d04805062c

memory/2656-0-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2656-5-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-11-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-14-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-15-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4908-19-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 e16a294246fd8970f099e58a3f9ab134
SHA1 47c567b1769887ddf27a9458e2506da9b5ad6c1d
SHA256 51a48afb71904f164f029ab6d1e73451501fb6ce12ecd590a3f14d47b9e8fa39
SHA512 1c6c2cba5bf996d5ad05a6a4b2a7ea7db847ccfef822ac2e4bcbd6301f94244745016a19e6bc2a5dcb6614e98c4d75fd666338bdcc767a70069b1afec0da3a0f

memory/3592-20-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3592-21-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3592-24-0x0000000000400000-0x000000000042D000-memory.dmp