Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2024 05:58

General

  • Target

    5b002622f8369ec9e804b185e9376fc0N.exe

  • Size

    96KB

  • MD5

    5b002622f8369ec9e804b185e9376fc0

  • SHA1

    4d077d57f02736b585f5a72c7625905b856dcfb2

  • SHA256

    0499beff84adc41da5dd97694023640d8fe1206730d8100ab5603b282af9e794

  • SHA512

    438d707898c5006cbbfc73fef6e0507deff238d90c75601fab5d16c28faef76f8fc4de7f463b6ac1ec825d5bbc9e5a4179678aacaa9223b8f9ba9dd4155992bc

  • SSDEEP

    1536:LnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:LGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
      C:\Users\Admin\AppData\Local\Temp\5b002622f8369ec9e804b185e9376fc0N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1276
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4288
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3624
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4820
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 268
                  8⤵
                  • Program crash
                  PID:3608
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 300
              6⤵
              • Program crash
              PID:4904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 300
          4⤵
          • Program crash
          PID:804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 272
      2⤵
      • Program crash
      PID:3828
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2052 -ip 2052
    1⤵
      PID:668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3256 -ip 3256
      1⤵
        PID:2004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4288 -ip 4288
        1⤵
          PID:3284
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3624 -ip 3624
          1⤵
            PID:3668

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            bf40239ec8612f010e1b9d8afd8b367f

            SHA1

            4c37a049d35a30425e531cf69aacdaa873763b93

            SHA256

            beb1d3e34b02e40e618ada2de92dddde6cfef48dd668476d802573666d70e0c1

            SHA512

            31437f2f3685848b6fb40e41bac3ec54ba7029a6877faf85b970ca579ddc390f24c32db14918d3d90a19c371a7737d16263fa85c3f537502dba5671390eeea97

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            aca1022c081ce186ae4b4d4579efd1d2

            SHA1

            c58f4d4ce2e1eeaeb24a0e24d945fcefdf97c621

            SHA256

            90a7ae08a40fc047bce158a671b79bc36c12c081c3fbc87e4cf5d844b3ae71a2

            SHA512

            2b2754bfdbea3257647294b4f1bd40c1ea2a14a0113a357ef4d995b3d45c6f758edcd4bbb135644106577d9c2a3507e61deadbb724ca6fe01c7ac82699731892

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            96KB

            MD5

            ae66a33cecf1abb3781aa9c4b3453c59

            SHA1

            37f03df8d8688f9aa25922ffd34ee28642227ef4

            SHA256

            edb895c723283d58116c4202108d1ec47a41e2549058d261ddef220795aee634

            SHA512

            3c6499bd81344d333ec2b64669b90dc0732413a56cc17965670d1e178a5d239f1faee57b4be71269e2ae0a259aa19afbc080d0b3afdf916493e896ae0bdaa200

          • memory/1276-23-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-15-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-20-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-26-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-27-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1276-31-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/2052-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2052-17-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2384-5-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/2384-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/2384-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/2384-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3256-8-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3256-19-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3524-38-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3524-40-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3524-37-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3624-44-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4288-32-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4288-52-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4820-50-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4820-49-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4820-54-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB