Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 06:54

General

  • Target

    43f1333d880fc73b01ecd2d0ebbd3370N.exe

  • Size

    134KB

  • MD5

    43f1333d880fc73b01ecd2d0ebbd3370

  • SHA1

    936df6890c1dc0bfad6f0ba0c517ee4ff028b6cc

  • SHA256

    dc6e701613bc61254f3f02b3e584e7462444789940d3727280086a8cebeef89a

  • SHA512

    b50eeb6948ed7c58f32054b008e334e3c05be438e3958ee0e301cc27ad2b6b9844d61828fc470dd93c9b9110f9213517f58e4507d32baa1b31224b9db2ddf7e8

  • SSDEEP

    1536:oDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:OiRTeH0NqAW6J6f1tqF6dngNmaZC7M

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
    "C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
      C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2212
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1624
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    134KB

    MD5

    3d7b5d84e8b2c05e47f7240af033ee95

    SHA1

    828a693d9127233cf978d1b9a42a4ae2c04f2ea3

    SHA256

    584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86

    SHA512

    a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    134KB

    MD5

    7d8439ccdf11d7e851ecdf1ce441ab4e

    SHA1

    d52ac78f5d1e1b09001d3293b9819bb9cd0137b0

    SHA256

    1d50b988ce6eb0cc36c7a5efc716a9eb99bbc49c33499ca89f05e7f960e3e464

    SHA512

    7912b77eba9e1bd387d3e45cb278545fef0d9b63ea3cd22581caf1ddd06e19b352f78c1ed98125b7dcc8f41f1be168f3e3ccf4ab2f295592a2e2fa03f6c6aa9b

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    134KB

    MD5

    be9bc9eea78cda6b10e7400ed99361fa

    SHA1

    c0eaa7e16583dd1fcfe5dbfd309a151f6f9f84b6

    SHA256

    3811e03cce1b96e5061d04a293fcb09025f649cc8f5861d69d289e46bb2f2d95

    SHA512

    64d5361696a17e3d21e24d2562863f9c24fdeaed273b6c9d1ada1a3881f39157ec7747b612d53eed04b754e4758714e60b6749536e46ea0d735d96454b0881e5

  • memory/1624-84-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/1624-76-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2036-86-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2080-1-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2080-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2080-5-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2080-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2080-18-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-42-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-36-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-45-0x0000000000350000-0x0000000000374000-memory.dmp

    Filesize

    144KB

  • memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-32-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2636-85-0x0000000000350000-0x0000000000374000-memory.dmp

    Filesize

    144KB

  • memory/2748-55-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2748-64-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2816-20-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2816-28-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2852-0-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2852-6-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB