Malware Analysis Report

2024-11-16 12:58

Sample ID 240818-k9qfnazcjr
Target d37325fa6d16e231fe954451da014930N.exe
SHA256 dabab0c6eb8f980f737cec377f243b17c7bc0ab4d8e85f7522a248d9de86bd71
Tags
neconyd discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dabab0c6eb8f980f737cec377f243b17c7bc0ab4d8e85f7522a248d9de86bd71

Threat Level: Known bad

The file d37325fa6d16e231fe954451da014930N.exe was found to be: Known bad.

Malicious Activity Summary

neconyd discovery trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 09:18

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 09:18

Reported

2024-08-18 09:20

Platform

win7-20240704-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2796 wrote to memory of 344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 344 wrote to memory of 2928 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 344 wrote to memory of 2928 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 344 wrote to memory of 2928 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 344 wrote to memory of 2928 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe

"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1e6f8d8858edb98fe550eca414b5edc6
SHA1 5028cceb6098d77590ba9f5c159799cf41bc154a
SHA256 096250bd2c0b57b42720425d766e3a7630f37771001fb5e16553a8812ea5a229
SHA512 5205723b13deba96a782c68d27732b6d19e283dd5d1fa099e7d7b71ee4f1abe99a9135bcbfebdece63f61ee0bc65da518c403a01ac22f99740a8268f498a76ea

\Windows\SysWOW64\omsecor.exe

MD5 5c000609e67c8f744b506292460bd334
SHA1 de45107228cd12b07d0bf10fd5e32b46414b79a1
SHA256 1b2153da8c4f374ae49a1c3ec50d3c1972cfdf3e42a353244278065ccf149f28
SHA512 a66ee126c4a7fa7c05691f6e6aadeed9b8182b48de383f1ff649be6cbcc905b69bde9438ed72eb934e4eabe44b02e9d4264a0b171d11e3c05ca01943a91d55af

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 16ec30c6a8e16045334a7bf543f37289
SHA1 b7f3208eff4e9f52fd2e26fff1d38d7ff32de9cb
SHA256 f64c5d1b5ee3daebbe1bdff34488dc31426a80e346f80de18994d71a0b7d7bfd
SHA512 80703485d676ab1c30e3c87bd894ee3e093a9516ac704665764f214e92a9a34a9e85d458cc552d69f7b1a0c7212a1467d8aadfa4db9bd93d4810fb42233e8841

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 09:18

Reported

2024-08-18 09:20

Platform

win10v2004-20240802-en

Max time kernel

114s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe

"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1e6f8d8858edb98fe550eca414b5edc6
SHA1 5028cceb6098d77590ba9f5c159799cf41bc154a
SHA256 096250bd2c0b57b42720425d766e3a7630f37771001fb5e16553a8812ea5a229
SHA512 5205723b13deba96a782c68d27732b6d19e283dd5d1fa099e7d7b71ee4f1abe99a9135bcbfebdece63f61ee0bc65da518c403a01ac22f99740a8268f498a76ea

C:\Windows\SysWOW64\omsecor.exe

MD5 2cbf7d33ae6537c3037a6d571b0c6335
SHA1 196131908da670bb498245458eb1b337463b4786
SHA256 6475598339bf2e02779607c56e09ff3f234087fdfb3345861bdc76879f0dd941
SHA512 00db487de4d7022722ae6af72d92c1b2a20825177b0b5ded32469bb4879a26459fe2e87547bc664234a43805a7f51f9d633f9109bed8badb56aef6776154f49f

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4dbedc1630af2f1e48cc2b0395f6e134
SHA1 a4656c4bac188dd6f2f73a08c401e78093481aa6
SHA256 9899e7762646c4ca83f49c4f962b4b32602ab678ecd43b1e18e8e1472664eb0a
SHA512 a9f7852e8556330f4552e1b8bea4b15b6bb90d0e09578c754bfa24631cfaf3be851e2c5abd5644e32e136d525ec6adce0b2379c05e4a0843361b8000b842d813