Analysis Overview
SHA256
dabab0c6eb8f980f737cec377f243b17c7bc0ab4d8e85f7522a248d9de86bd71
Threat Level: Known bad
The file d37325fa6d16e231fe954451da014930N.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd family
Neconyd
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-18 09:18
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-18 09:18
Reported
2024-08-18 09:20
Platform
win7-20240704-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe
"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 1e6f8d8858edb98fe550eca414b5edc6 |
| SHA1 | 5028cceb6098d77590ba9f5c159799cf41bc154a |
| SHA256 | 096250bd2c0b57b42720425d766e3a7630f37771001fb5e16553a8812ea5a229 |
| SHA512 | 5205723b13deba96a782c68d27732b6d19e283dd5d1fa099e7d7b71ee4f1abe99a9135bcbfebdece63f61ee0bc65da518c403a01ac22f99740a8268f498a76ea |
\Windows\SysWOW64\omsecor.exe
| MD5 | 5c000609e67c8f744b506292460bd334 |
| SHA1 | de45107228cd12b07d0bf10fd5e32b46414b79a1 |
| SHA256 | 1b2153da8c4f374ae49a1c3ec50d3c1972cfdf3e42a353244278065ccf149f28 |
| SHA512 | a66ee126c4a7fa7c05691f6e6aadeed9b8182b48de383f1ff649be6cbcc905b69bde9438ed72eb934e4eabe44b02e9d4264a0b171d11e3c05ca01943a91d55af |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 16ec30c6a8e16045334a7bf543f37289 |
| SHA1 | b7f3208eff4e9f52fd2e26fff1d38d7ff32de9cb |
| SHA256 | f64c5d1b5ee3daebbe1bdff34488dc31426a80e346f80de18994d71a0b7d7bfd |
| SHA512 | 80703485d676ab1c30e3c87bd894ee3e093a9516ac704665764f214e92a9a34a9e85d458cc552d69f7b1a0c7212a1467d8aadfa4db9bd93d4810fb42233e8841 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-18 09:18
Reported
2024-08-18 09:20
Platform
win10v2004-20240802-en
Max time kernel
114s
Max time network
118s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe
"C:\Users\Admin\AppData\Local\Temp\d37325fa6d16e231fe954451da014930N.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 52.111.227.14:443 | tcp | |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 1e6f8d8858edb98fe550eca414b5edc6 |
| SHA1 | 5028cceb6098d77590ba9f5c159799cf41bc154a |
| SHA256 | 096250bd2c0b57b42720425d766e3a7630f37771001fb5e16553a8812ea5a229 |
| SHA512 | 5205723b13deba96a782c68d27732b6d19e283dd5d1fa099e7d7b71ee4f1abe99a9135bcbfebdece63f61ee0bc65da518c403a01ac22f99740a8268f498a76ea |
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 2cbf7d33ae6537c3037a6d571b0c6335 |
| SHA1 | 196131908da670bb498245458eb1b337463b4786 |
| SHA256 | 6475598339bf2e02779607c56e09ff3f234087fdfb3345861bdc76879f0dd941 |
| SHA512 | 00db487de4d7022722ae6af72d92c1b2a20825177b0b5ded32469bb4879a26459fe2e87547bc664234a43805a7f51f9d633f9109bed8badb56aef6776154f49f |
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 4dbedc1630af2f1e48cc2b0395f6e134 |
| SHA1 | a4656c4bac188dd6f2f73a08c401e78093481aa6 |
| SHA256 | 9899e7762646c4ca83f49c4f962b4b32602ab678ecd43b1e18e8e1472664eb0a |
| SHA512 | a9f7852e8556330f4552e1b8bea4b15b6bb90d0e09578c754bfa24631cfaf3be851e2c5abd5644e32e136d525ec6adce0b2379c05e4a0843361b8000b842d813 |