Malware Analysis Report

2024-11-16 12:57

Sample ID 240817-z7c5waxelh
Target af03db893046edb55688188795937cd0N.exe
SHA256 ea8c02ea356974b180c0aebc7684a5b67854abe7a9282003cd7f9d8ea88e5ee0
Tags
neconyd discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea8c02ea356974b180c0aebc7684a5b67854abe7a9282003cd7f9d8ea88e5ee0

Threat Level: Known bad

The file af03db893046edb55688188795937cd0N.exe was found to be: Known bad.

Malicious Activity Summary

neconyd discovery trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-17 21:21

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-17 21:21

Reported

2024-08-17 21:23

Platform

win7-20240708-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2372 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2372 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2372 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2996 wrote to memory of 2432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2996 wrote to memory of 2432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2996 wrote to memory of 2432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2996 wrote to memory of 2432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe

"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 681b0cb2d510ab42683f42fbb6434e61
SHA1 6d4e72cd08bd9e8fadf8ebddc16694bdb7d74809
SHA256 9921ef54daf7b16d22571558fd0cf30ca5b9aedfeba60814d0c9ced2ec4dcd96
SHA512 9e53317f1bb41bc5ba9e88f46f9297e4a6cbf6d3adc1d8d3dc300cd59b0a9063aab1190d63894cf87497ed9f2b9c5a3c52e18e7e7942f9f3c76165fe89c2faf8

\Windows\SysWOW64\omsecor.exe

MD5 1480cfffe11ef7da0273102b8508ff63
SHA1 07ba14a8f0617f37066a616153b03b12721b3a39
SHA256 b043a760d5156ccaa6e34979b46ed587a8ad0fcb752a0af7d39137822c00b601
SHA512 e85f44608d852e9dfbbdbc2d957d36623cfdc3a25eaad4b2e9f225b098cf3af69781f0da78a7a3cebbac379d47e8db437031cbda7268ed6af34676a248538bcd

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 530669696c3a63a6692f12d3a408edba
SHA1 9410b23e226aeadf9af8277ba40bdc67f9f473cc
SHA256 a0fd0f6c82c941c2bbdf748a0266913d7979b9ca8aafb36a214b89260cc8b8b2
SHA512 6603e639b4c8bec3a1903ffbd6bb2b8e025dacf938456b2be635d74068dc96981c98a5148877ee42299b7e6dcc102d97105030b68c6ce8a95e97b72086e6cb4d

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-17 21:21

Reported

2024-08-17 21:23

Platform

win10v2004-20240802-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe

"C:\Users\Admin\AppData\Local\Temp\af03db893046edb55688188795937cd0N.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 681b0cb2d510ab42683f42fbb6434e61
SHA1 6d4e72cd08bd9e8fadf8ebddc16694bdb7d74809
SHA256 9921ef54daf7b16d22571558fd0cf30ca5b9aedfeba60814d0c9ced2ec4dcd96
SHA512 9e53317f1bb41bc5ba9e88f46f9297e4a6cbf6d3adc1d8d3dc300cd59b0a9063aab1190d63894cf87497ed9f2b9c5a3c52e18e7e7942f9f3c76165fe89c2faf8

C:\Windows\SysWOW64\omsecor.exe

MD5 808672cbe0ac6acfca028098ae5f133b
SHA1 7f9e17a7806688c37b895cdd266008e044263adf
SHA256 eb5107d520b77607d4fbb2d729b0d66d567339ea3d99229d4547e2571ddfa336
SHA512 8898f4156620cd2f98fb856a89cae02eeb7c089cd823f37a2c96ff9c56aab4caf0cdfd6325d9a987fcf4056b5fee415f3f4bfc8f55c0bb369f68687f1690d3e2

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 72fff64e94197d9f5f7144e9412d2cf6
SHA1 d17ee441f5f923c8d23a5474c431a413af431866
SHA256 215e70d8f6aea410585a2b5b2792fd0e67395191cdf3a9f451e8be758caf7af3
SHA512 fe76244cb23cacdfd44abf3463121b545899eefabfa63f99006ba83edc83768414e12f2de78ea7c236b1be1eac624211911c662a50153d81d32ae7f82c0cde49