Analysis Overview
SHA256
ea8c02ea356974b180c0aebc7684a5b67854abe7a9282003cd7f9d8ea88e5ee0
Threat Level: Known bad
The file af03db893046edb55688188795937cd0N.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd
Neconyd family
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-17 21:21
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-17 21:21
Reported
2024-08-17 21:23
Platform
win7-20240708-en
Max time kernel
117s
Max time network
123s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 681b0cb2d510ab42683f42fbb6434e61 |
| SHA1 | 6d4e72cd08bd9e8fadf8ebddc16694bdb7d74809 |
| SHA256 | 9921ef54daf7b16d22571558fd0cf30ca5b9aedfeba60814d0c9ced2ec4dcd96 |
| SHA512 | 9e53317f1bb41bc5ba9e88f46f9297e4a6cbf6d3adc1d8d3dc300cd59b0a9063aab1190d63894cf87497ed9f2b9c5a3c52e18e7e7942f9f3c76165fe89c2faf8 |
\Windows\SysWOW64\omsecor.exe
| MD5 | 1480cfffe11ef7da0273102b8508ff63 |
| SHA1 | 07ba14a8f0617f37066a616153b03b12721b3a39 |
| SHA256 | b043a760d5156ccaa6e34979b46ed587a8ad0fcb752a0af7d39137822c00b601 |
| SHA512 | e85f44608d852e9dfbbdbc2d957d36623cfdc3a25eaad4b2e9f225b098cf3af69781f0da78a7a3cebbac379d47e8db437031cbda7268ed6af34676a248538bcd |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 530669696c3a63a6692f12d3a408edba |
| SHA1 | 9410b23e226aeadf9af8277ba40bdc67f9f473cc |
| SHA256 | a0fd0f6c82c941c2bbdf748a0266913d7979b9ca8aafb36a214b89260cc8b8b2 |
| SHA512 | 6603e639b4c8bec3a1903ffbd6bb2b8e025dacf938456b2be635d74068dc96981c98a5148877ee42299b7e6dcc102d97105030b68c6ce8a95e97b72086e6cb4d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-17 21:21
Reported
2024-08-17 21:23
Platform
win10v2004-20240802-en
Max time kernel
117s
Max time network
123s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 681b0cb2d510ab42683f42fbb6434e61 |
| SHA1 | 6d4e72cd08bd9e8fadf8ebddc16694bdb7d74809 |
| SHA256 | 9921ef54daf7b16d22571558fd0cf30ca5b9aedfeba60814d0c9ced2ec4dcd96 |
| SHA512 | 9e53317f1bb41bc5ba9e88f46f9297e4a6cbf6d3adc1d8d3dc300cd59b0a9063aab1190d63894cf87497ed9f2b9c5a3c52e18e7e7942f9f3c76165fe89c2faf8 |
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 808672cbe0ac6acfca028098ae5f133b |
| SHA1 | 7f9e17a7806688c37b895cdd266008e044263adf |
| SHA256 | eb5107d520b77607d4fbb2d729b0d66d567339ea3d99229d4547e2571ddfa336 |
| SHA512 | 8898f4156620cd2f98fb856a89cae02eeb7c089cd823f37a2c96ff9c56aab4caf0cdfd6325d9a987fcf4056b5fee415f3f4bfc8f55c0bb369f68687f1690d3e2 |
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 72fff64e94197d9f5f7144e9412d2cf6 |
| SHA1 | d17ee441f5f923c8d23a5474c431a413af431866 |
| SHA256 | 215e70d8f6aea410585a2b5b2792fd0e67395191cdf3a9f451e8be758caf7af3 |
| SHA512 | fe76244cb23cacdfd44abf3463121b545899eefabfa63f99006ba83edc83768414e12f2de78ea7c236b1be1eac624211911c662a50153d81d32ae7f82c0cde49 |