Analysis Overview
SHA256
dc6e701613bc61254f3f02b3e584e7462444789940d3727280086a8cebeef89a
Threat Level: Known bad
The file 43f1333d880fc73b01ecd2d0ebbd3370N.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd
Loads dropped DLL
Executes dropped EXE
Suspicious use of SetThreadContext
Drops file in System32 directory
System Location Discovery: System Language Discovery
Program crash
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-18 06:54
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-18 06:54
Reported
2024-08-18 06:56
Platform
win7-20240705-en
Max time kernel
114s
Max time network
119s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2852 set thread context of 2080 | N/A | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe |
| PID 2816 set thread context of 2636 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2748 set thread context of 2212 | N/A | C:\Windows\SysWOW64\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 1624 set thread context of 2036 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
memory/2852-0-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2080-1-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2080-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2852-6-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2080-5-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2080-8-0x0000000000400000-0x0000000000429000-memory.dmp
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 3d7b5d84e8b2c05e47f7240af033ee95 |
| SHA1 | 828a693d9127233cf978d1b9a42a4ae2c04f2ea3 |
| SHA256 | 584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86 |
| SHA512 | a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba |
memory/2816-28-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2816-20-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2080-18-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2636-32-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2636-36-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2636-42-0x0000000000400000-0x0000000000429000-memory.dmp
\Windows\SysWOW64\omsecor.exe
| MD5 | be9bc9eea78cda6b10e7400ed99361fa |
| SHA1 | c0eaa7e16583dd1fcfe5dbfd309a151f6f9f84b6 |
| SHA256 | 3811e03cce1b96e5061d04a293fcb09025f649cc8f5861d69d289e46bb2f2d95 |
| SHA512 | 64d5361696a17e3d21e24d2562863f9c24fdeaed273b6c9d1ada1a3881f39157ec7747b612d53eed04b754e4758714e60b6749536e46ea0d735d96454b0881e5 |
memory/2636-45-0x0000000000350000-0x0000000000374000-memory.dmp
memory/2748-55-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2748-64-0x0000000000400000-0x0000000000424000-memory.dmp
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 7d8439ccdf11d7e851ecdf1ce441ab4e |
| SHA1 | d52ac78f5d1e1b09001d3293b9819bb9cd0137b0 |
| SHA256 | 1d50b988ce6eb0cc36c7a5efc716a9eb99bbc49c33499ca89f05e7f960e3e464 |
| SHA512 | 7912b77eba9e1bd387d3e45cb278545fef0d9b63ea3cd22581caf1ddd06e19b352f78c1ed98125b7dcc8f41f1be168f3e3ccf4ab2f295592a2e2fa03f6c6aa9b |
memory/1624-76-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1624-84-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2636-85-0x0000000000350000-0x0000000000374000-memory.dmp
memory/2036-86-0x0000000000400000-0x0000000000429000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-18 06:54
Reported
2024-08-18 06:56
Platform
win10v2004-20240802-en
Max time kernel
116s
Max time network
125s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1116 set thread context of 3916 | N/A | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe |
| PID 2712 set thread context of 3272 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 1944 set thread context of 4692 | N/A | C:\Windows\SysWOW64\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 2764 set thread context of 1832 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1116 -ip 1116
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 288
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2712 -ip 2712
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 288
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1944 -ip 1944
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2764 -ip 2764
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 256
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
memory/1116-0-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3916-1-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3916-2-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3916-3-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 3d7b5d84e8b2c05e47f7240af033ee95 |
| SHA1 | 828a693d9127233cf978d1b9a42a4ae2c04f2ea3 |
| SHA256 | 584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86 |
| SHA512 | a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba |
memory/2712-9-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3916-6-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-14-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2712-17-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1116-18-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3272-19-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-22-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-26-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3272-30-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 79e9a8fb680fe7636871e4bbfdb83f05 |
| SHA1 | bef4d34e0bedccd1cb7ff929581d4403cf9d4154 |
| SHA256 | d449ed7d9735c38a6aa75a5729f148bd221200ca81be336f19a5442f38b66c7f |
| SHA512 | 21254d90ee39ec3248d8b19238b91fa2c9141578372d602641786dddc2b7801422847dc412632aaa5b2485d50bfd03ae1eaa6cc0e67e531f6d426b4a98f3186a |
memory/1944-31-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4692-37-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4692-36-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 13c0f95243bc1d501f9b8eec370f5942 |
| SHA1 | 0946eb0c861e715407cc767dd547a82312edb279 |
| SHA256 | f3b26927e40f90459a78c25d9facea12ab8ba425738bafbeec685544df6f6071 |
| SHA512 | f09a5e959f171205747f551e51f859027ebb5177138b89041db54208bf0749a94a9c5a52cdc46266422bb5fc68158b3bcd13d9a64f5a0040624a8c62dc057edb |
memory/4692-41-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1832-48-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1832-49-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2764-44-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1944-50-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2764-51-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1832-52-0x0000000000400000-0x0000000000429000-memory.dmp