Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 23:07
Behavioral task
behavioral1
Sample
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe
Resource
win7-20240704-en
General
-
Target
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe
-
Size
76KB
-
MD5
37c81df7c6270c8129624a139fedeb6a
-
SHA1
c87aec5e390a761a6c0a9b2112bc3ebc286abbc2
-
SHA256
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef
-
SHA512
ad0d2512c07eeb31bef0ec35767e2d977899ead864eefbe75c1f626fc88c0ad491694a94aa4b2219353cc94fb1ef5520c9aabb49c496bf631b8c2e526d1e0fef
-
SSDEEP
1536:td9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:FdseIOMEZEyFjEOFqaiQm5l/5w11
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 1036 omsecor.exe 1304 omsecor.exe 2032 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exeomsecor.exeomsecor.exepid process 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe 1036 omsecor.exe 1036 omsecor.exe 1304 omsecor.exe 1304 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exeomsecor.exeomsecor.exeomsecor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exeomsecor.exeomsecor.exedescription pid process target process PID 2120 wrote to memory of 1036 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe omsecor.exe PID 2120 wrote to memory of 1036 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe omsecor.exe PID 2120 wrote to memory of 1036 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe omsecor.exe PID 2120 wrote to memory of 1036 2120 8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe omsecor.exe PID 1036 wrote to memory of 1304 1036 omsecor.exe omsecor.exe PID 1036 wrote to memory of 1304 1036 omsecor.exe omsecor.exe PID 1036 wrote to memory of 1304 1036 omsecor.exe omsecor.exe PID 1036 wrote to memory of 1304 1036 omsecor.exe omsecor.exe PID 1304 wrote to memory of 2032 1304 omsecor.exe omsecor.exe PID 1304 wrote to memory of 2032 1304 omsecor.exe omsecor.exe PID 1304 wrote to memory of 2032 1304 omsecor.exe omsecor.exe PID 1304 wrote to memory of 2032 1304 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe"C:\Users\Admin\AppData\Local\Temp\8831b9da4e7dd9e6c4bf3a0e1d4193957fe6046318589c71b87259126e678fef.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5a639974ea04c32e174b32a297197b908
SHA1d9248f783e843fd8198651f8728c84be10f984dd
SHA2567aa5efad40373524ce281b7f06edc625f978e3280efad571bdc377722d1a488a
SHA51201c9281cbafe4b0536225acfb6a3d19e46670189e45cf7d518818ba2d667922eac8225f584066fc781552d6ca7a78fb7233e647733ec44bcbe1aef8e2b7eb126
-
Filesize
76KB
MD57d42898196a1ec95d4d0ee5cf5b4404b
SHA1c8d54ad4938e4258f2891cc6aca33d0ab4e042a0
SHA256820483cd845697e6950cc73974cc181cdd75ba57b1bfc4fe45ea94b1307fa422
SHA512ab3c0616f1d21bba15bfdad90245375a8046093b26a920c9e36f6257dc60d0e8f404b4d0d3ab7f37fc1240cad87bc83de807e45cf510522573c79738d7813893
-
Filesize
76KB
MD580d58be31b5d0f684b90a0ba16861ad7
SHA1a758ee3f1278973da43d5631d9d0d800b1b0269b
SHA256ae0fe6cf5faf562c2150966ca2419d0e7af3f57240db8d53e478e204c49b1c9e
SHA51250cffc1253115ea7b9f703526fd4c21c4cfdf2511859c01817e2ba896c9b24004b687a26762555c9a5cc308041ca1342999e5ade17e9077bfe7d4e8f06fce09b