Analysis

  • max time kernel
    116s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2024 06:54

General

  • Target

    43f1333d880fc73b01ecd2d0ebbd3370N.exe

  • Size

    134KB

  • MD5

    43f1333d880fc73b01ecd2d0ebbd3370

  • SHA1

    936df6890c1dc0bfad6f0ba0c517ee4ff028b6cc

  • SHA256

    dc6e701613bc61254f3f02b3e584e7462444789940d3727280086a8cebeef89a

  • SHA512

    b50eeb6948ed7c58f32054b008e334e3c05be438e3958ee0e301cc27ad2b6b9844d61828fc470dd93c9b9110f9213517f58e4507d32baa1b31224b9db2ddf7e8

  • SSDEEP

    1536:oDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:OiRTeH0NqAW6J6f1tqF6dngNmaZC7M

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
    "C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
      C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1944
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1832
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 256
                  8⤵
                  • Program crash
                  PID:872
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 292
              6⤵
              • Program crash
              PID:1224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 288
          4⤵
          • Program crash
          PID:1916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 288
      2⤵
      • Program crash
      PID:2024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1116 -ip 1116
    1⤵
      PID:4300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2712 -ip 2712
      1⤵
        PID:4188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1944 -ip 1944
        1⤵
          PID:2816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2764 -ip 2764
          1⤵
            PID:4564

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            134KB

            MD5

            13c0f95243bc1d501f9b8eec370f5942

            SHA1

            0946eb0c861e715407cc767dd547a82312edb279

            SHA256

            f3b26927e40f90459a78c25d9facea12ab8ba425738bafbeec685544df6f6071

            SHA512

            f09a5e959f171205747f551e51f859027ebb5177138b89041db54208bf0749a94a9c5a52cdc46266422bb5fc68158b3bcd13d9a64f5a0040624a8c62dc057edb

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            134KB

            MD5

            3d7b5d84e8b2c05e47f7240af033ee95

            SHA1

            828a693d9127233cf978d1b9a42a4ae2c04f2ea3

            SHA256

            584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86

            SHA512

            a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            134KB

            MD5

            79e9a8fb680fe7636871e4bbfdb83f05

            SHA1

            bef4d34e0bedccd1cb7ff929581d4403cf9d4154

            SHA256

            d449ed7d9735c38a6aa75a5729f148bd221200ca81be336f19a5442f38b66c7f

            SHA512

            21254d90ee39ec3248d8b19238b91fa2c9141578372d602641786dddc2b7801422847dc412632aaa5b2485d50bfd03ae1eaa6cc0e67e531f6d426b4a98f3186a

          • memory/1116-18-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1116-0-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1832-52-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1832-49-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1832-48-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1944-50-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1944-31-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2712-17-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2712-9-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2764-44-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2764-51-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3272-26-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-22-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-30-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-19-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-16-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3272-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3916-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3916-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3916-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3916-6-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4692-37-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4692-41-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4692-36-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB