Malware Analysis Report

2024-09-11 08:29

Sample ID 240623-zv7tqa1gqb
Target 41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4
SHA256 41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4

Threat Level: Known bad

The file 41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-23 21:03

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 21:03

Reported

2024-06-23 21:05

Platform

win7-20240221-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 756 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2360 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2360 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2360 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2360 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2028 wrote to memory of 380 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2028 wrote to memory of 380 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2028 wrote to memory of 380 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2028 wrote to memory of 380 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe

"C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 710f10ae496edf96eeea12185c7c956c
SHA1 0c031bc6e3be19c7473dad0cd348229b357e5476
SHA256 02cace1c3f35801833dfe9d713e8b7c09b27c91187f7f7c69f96d7a6389765ae
SHA512 cebac3fa461ff60ff58243a6d72d0fd8bb17693b23c5f15b833454651f7b6df63100ce9100df569a9cfb297cc087cb2d5fecbb089e601561f04fc3b13671ab98

\Windows\SysWOW64\omsecor.exe

MD5 f0b7f15860ee29df3494521946f68dd9
SHA1 c81a0089fb631cf06496a1204e0c9de6e6f2c3f0
SHA256 b9348d9a0a324273638a5a1400d7c110d3375b8f5ebd03e5688b8a424df13da5
SHA512 2441c23bc5934d3db215b0d1ad56eeb363e47bd1adbd3c3f9b6f86712ab0de98a0e464c3b3eae1acd33a98a4a705789ee44fb0826c06fbdcb003c3d19b71434e

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6dcbf8399fd104c9caf03cc406121d94
SHA1 d5bb615c3ce563be7b885be8ec26c83cbb3a475f
SHA256 9e6fb0736d9895422cf14850fd5d6593d7f94582ed1214cc9f43809879212b4a
SHA512 7db8398437a016b8035d2a45b4af8529d968d56ea3ec49ad4fbf2ce43ad10e6daeaa77599671f3866219eaef29d87424bff7d0aad254246dbda6f411d9104ab5

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 21:03

Reported

2024-06-23 21:06

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4228 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4228 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4228 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 936 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 936 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe

"C:\Users\Admin\AppData\Local\Temp\41a790fea25447774b7750a6d9cbda6b4cc2477c14bda934572737b8a60f2cd4.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 710f10ae496edf96eeea12185c7c956c
SHA1 0c031bc6e3be19c7473dad0cd348229b357e5476
SHA256 02cace1c3f35801833dfe9d713e8b7c09b27c91187f7f7c69f96d7a6389765ae
SHA512 cebac3fa461ff60ff58243a6d72d0fd8bb17693b23c5f15b833454651f7b6df63100ce9100df569a9cfb297cc087cb2d5fecbb089e601561f04fc3b13671ab98

C:\Windows\SysWOW64\omsecor.exe

MD5 58e2bdfaca67fa25efd3d8e4c27f1eb7
SHA1 4a08000c9fbe9df4d9b4396a695924dd9d08246a
SHA256 0e46ab68b9c331188a2154f8b52c1dfc0949c9a7a2af78e78cd3f288d0bcc9fb
SHA512 b9bc5ec9b77784ff75a94ec5135fd42f3e4541a7e84764ff7cc95e8f1abf7f89f6f6be2bc2562e5825e02afba82e40e643fb43ec78d0c325127c21399d817f15