Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 05:58

General

  • Target

    5b002622f8369ec9e804b185e9376fc0N.exe

  • Size

    96KB

  • MD5

    5b002622f8369ec9e804b185e9376fc0

  • SHA1

    4d077d57f02736b585f5a72c7625905b856dcfb2

  • SHA256

    0499beff84adc41da5dd97694023640d8fe1206730d8100ab5603b282af9e794

  • SHA512

    438d707898c5006cbbfc73fef6e0507deff238d90c75601fab5d16c28faef76f8fc4de7f463b6ac1ec825d5bbc9e5a4179678aacaa9223b8f9ba9dd4155992bc

  • SSDEEP

    1536:LnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:LGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
      C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2920
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3052
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1152
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    aca1022c081ce186ae4b4d4579efd1d2

    SHA1

    c58f4d4ce2e1eeaeb24a0e24d945fcefdf97c621

    SHA256

    90a7ae08a40fc047bce158a671b79bc36c12c081c3fbc87e4cf5d844b3ae71a2

    SHA512

    2b2754bfdbea3257647294b4f1bd40c1ea2a14a0113a357ef4d995b3d45c6f758edcd4bbb135644106577d9c2a3507e61deadbb724ca6fe01c7ac82699731892

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    7a8f7c59bbb9af784ac55885c7dbbcfb

    SHA1

    8d79e7d3fe7e048ea44b6cc08a1a7743d6775a3a

    SHA256

    9b8f87a04a8de462330493773489db5a0b4274415b9c3875eb9e6d3e7978d242

    SHA512

    349ea00a1731f48c9bccaf0dcfec09aea29a30a52f035f33692dc91d6efffa0d05c725dc07d7dedcbbe1f3b4eb26ba0a7ee00578ee5f9363aa363462ab553e71

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    96KB

    MD5

    873d0674c0111283bed51673f6698760

    SHA1

    9f32b0cdf83a2d852765aa22de5f1664a4288fcf

    SHA256

    6ea7f6939aee5a67cccc560437a120f6b8bfb1a6ed39ff2a86b22449899975ca

    SHA512

    241cb39f7b29080f0349e9a9cf4df43a326918f0be121202c8995c8b0d1ebc6420c691690311b933d10807784d60cd2e9b981e04cbb090db1c79a28182f00256

  • memory/1152-86-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2612-35-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2612-55-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2612-47-0x0000000000290000-0x00000000002B3000-memory.dmp

    Filesize

    140KB

  • memory/2612-44-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2612-41-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2612-38-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2708-32-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2708-24-0x00000000001C0000-0x00000000001E3000-memory.dmp

    Filesize

    140KB

  • memory/2708-21-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2740-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2740-8-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2800-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2800-5-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-2-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2920-65-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/3052-71-0x0000000000230000-0x0000000000253000-memory.dmp

    Filesize

    140KB

  • memory/3060-88-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB