Analysis Overview
SHA256
51d84e686e08670c1f067b280170fff2323c461ba7e85f9a24c95495c9fb7074
Threat Level: Known bad
The file 62370797b3bc357baadfe0b128785440N.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd family
Neconyd
Executes dropped EXE
UPX packed file
Loads dropped DLL
Drops file in System32 directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-17 00:04
Signatures
Neconyd family
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-17 00:04
Reported
2024-08-17 00:06
Platform
win7-20240708-en
Max time kernel
114s
Max time network
118s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe
"C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
memory/2876-0-0x0000000000400000-0x000000000043E000-memory.dmp
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | e942c57d288f971a9901c4b7e782c5de |
| SHA1 | a0d2f805064382407a99b870ca24dc57b61b8264 |
| SHA256 | c4ee41d4096c0a42d3d5bc83f98001959079d40d14c649517463fb059e62ed38 |
| SHA512 | 1bb11577f11be857b56504c4c588412e86145efb6c90d06f101db1757807b9496a5c9e9649ee578b3455f8796ba912253afa65ec4b92944eb3610538b57568ae |
memory/1852-12-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2876-10-0x00000000002D0000-0x000000000030E000-memory.dmp
memory/2876-9-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2876-8-0x00000000002D0000-0x000000000030E000-memory.dmp
memory/1852-14-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1852-24-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Windows\SysWOW64\omsecor.exe
| MD5 | ad2902deec9560986021eecd60f56f3d |
| SHA1 | bc67d4252f6aab330fdf429d2eadfff33f15853f |
| SHA256 | df6ee5d33282892542a04f2fec7041605c38f8afffc617a4f2458e67e795d7e4 |
| SHA512 | d6a2308e75f90dd10c3a303c4564b0c410a9883c9c4bfb5f2f5da85c1e147208f2f7a8b6b759657db123de058709e1223ccebd9277942cab58b88a189183bb7e |
memory/2404-28-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2404-31-0x0000000000220000-0x000000000025E000-memory.dmp
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | bf5351455d5032ce8072938cae875ad6 |
| SHA1 | 0bbc8b4207ab114b3faf76a531890e0cd0762fe1 |
| SHA256 | a938a21be8a755c9da53a9289fc496ba9f50bdee74624a62aaa14c61fb400a3a |
| SHA512 | 47db6fcd3ccfb3eae25633052d894ab728010cfc089578d07a534329ce78aa11d5bbf60cd55b015ff349acd5ee0ac10b6ef478298d8ef717f0bbb17e766a870d |
memory/2536-37-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2536-39-0x0000000000400000-0x000000000043E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-17 00:04
Reported
2024-08-17 00:06
Platform
win10v2004-20240802-en
Max time kernel
114s
Max time network
118s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe
"C:\Users\Admin\AppData\Local\Temp\62370797b3bc357baadfe0b128785440N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
memory/5024-0-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | e942c57d288f971a9901c4b7e782c5de |
| SHA1 | a0d2f805064382407a99b870ca24dc57b61b8264 |
| SHA256 | c4ee41d4096c0a42d3d5bc83f98001959079d40d14c649517463fb059e62ed38 |
| SHA512 | 1bb11577f11be857b56504c4c588412e86145efb6c90d06f101db1757807b9496a5c9e9649ee578b3455f8796ba912253afa65ec4b92944eb3610538b57568ae |
memory/4912-4-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5024-5-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4912-7-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 088b0e3f4d667fd20fde6c87d6630bff |
| SHA1 | 8db140045667610660efea07d19c0c83080ae286 |
| SHA256 | 90bdff023fd6b2f7168516ca0d2a066ebd812f1488dc48dfc488f0c18e2c6a73 |
| SHA512 | 235b7c632c9ea8915bbe7587c0a902cc5625a0080367880f3c746a8d210306a3c1cffb57017ea8665e82c89ff4e68e1e7427f57212108d6f000342c20ba406dc |
memory/1812-11-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4912-12-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1812-17-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4016-18-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 29d1b7973a78bae2b5cb87639ffd76d0 |
| SHA1 | 8dc6260599c3b009e49a956a65398ecb142ab0b9 |
| SHA256 | deb52978f255b20b73e62fde4ca0792cf7d493876bd7ebad004e27d64ac1ca52 |
| SHA512 | 0568cb45e5355c4c745f7846e67211f3d7e1d3ba1b2c468f5a9dd772cbc646df4dee5d33be4bd024077f70295d7cbdaf0d56ef88350c86c3a7d4251f14451131 |
memory/4016-20-0x0000000000400000-0x000000000043E000-memory.dmp