Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 09:15

General

  • Target

    2b7b7ff52de860b729fdf80c48091be0N.exe

  • Size

    134KB

  • MD5

    2b7b7ff52de860b729fdf80c48091be0

  • SHA1

    ea9926aff20c7767152a41cd9755009146aeae8f

  • SHA256

    b06d7cd428c59e8ed614c3bf2475cadb03e6d20299fca47fd545fe5f7993be37

  • SHA512

    2df0b1699abb5bea2a5ee8cd5712c6e4a9fb5e8ffb79283be529ffb1bbbe72eee4c82db89f35f5ec1d529285d87f25f9c7787235648f66b62f7eea7f7fa5e967

  • SSDEEP

    1536:sDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:SiRTeH0NqAW6J6f1tqF6dngNmaZC7M

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b7b7ff52de860b729fdf80c48091be0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2b7b7ff52de860b729fdf80c48091be0N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\2b7b7ff52de860b729fdf80c48091be0N.exe
      C:\Users\Admin\AppData\Local\Temp\2b7b7ff52de860b729fdf80c48091be0N.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:796
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1880
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1292
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    134KB

    MD5

    d59a13ea72f897a24726076db30846c7

    SHA1

    0a022af01e295d08a70ecdf5d5b750d3ebddcc83

    SHA256

    34d79aa25375ad114221a9943231552ac55b3efd3227dede0ca13e866762d264

    SHA512

    ac058deeff0f3cf0ad8bffdc5ef0e186697c1d86730edec624f11dba8429a084b19f46209e63e9e24f762bd8b6cd178fd95e264b02d65efb85113513f1339977

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    134KB

    MD5

    38a2f8360d54708fa2685e1bce9232c1

    SHA1

    0a5b2ef92873883c607a3a3a4fb2355e2b3a44f7

    SHA256

    e220dc1d4c880a7575f23101fbf9693b8142f87f8e6e78ca7724cec401e6248a

    SHA512

    602d92f6863586f44d6ebbfd41cafb1318ec5f78ff21426d91f240068b415230fee1ad9498a0058c3e054661975a954da65e4aaa8decbfdef219cd48280c605b

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    134KB

    MD5

    a7dac709ac7abdc75edadf9591d5a6ec

    SHA1

    c670ce6e146b68505ed77bbf1c00328b54a79b07

    SHA256

    b153feefb6c7c36d45a5090d8ac3e61f05ca08b8df123bff1271a0a83e5c4eba

    SHA512

    7b0ed57f51efca9ba968beab877e455b061aa08fe8d035c061b03a9cf27593f0c20d9666081dabf57d885614eec1a4bc94e0979af801e8ad1f8d6a697eff97aa

  • memory/796-56-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/796-65-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/1292-78-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/1292-85-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/1880-76-0x00000000003B0000-0x00000000003D4000-memory.dmp

    Filesize

    144KB

  • memory/1880-87-0x00000000003B0000-0x00000000003D4000-memory.dmp

    Filesize

    144KB

  • memory/1940-88-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2040-0-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2040-6-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2348-30-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2348-23-0x0000000000230000-0x0000000000254000-memory.dmp

    Filesize

    144KB

  • memory/2348-20-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2632-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2632-5-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2632-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2632-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2632-2-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2992-36-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2992-51-0x0000000000290000-0x00000000002B4000-memory.dmp

    Filesize

    144KB

  • memory/2992-52-0x0000000000290000-0x00000000002B4000-memory.dmp

    Filesize

    144KB

  • memory/2992-54-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2992-42-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2992-39-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2992-33-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB