Analysis Overview
SHA256
027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0
Threat Level: Known bad
The file 027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0 was found to be: Known bad.
Malicious Activity Summary
Neconyd family
Neconyd
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-18 18:16
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-18 18:16
Reported
2024-08-18 18:18
Platform
win7-20240729-en
Max time kernel
145s
Max time network
146s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe
"C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 2ccdfbde0854295311e04da7faae2278 |
| SHA1 | 798bdc2f05da5807900a4517559aa3cbf5ef47c4 |
| SHA256 | 7b7ad20320a4a09461541d1d666a67e5c20f7c083e53f86ca6b9fac7d5bcdd72 |
| SHA512 | 43a9fd37c376f5d21490e2ba29dffc43296e940857e6cac629ecf971bb8a429c87d944b372dedc8f9e9c320aa23da831d7f12378e3cc6eef510eaf65cfa6a7fc |
\Windows\SysWOW64\omsecor.exe
| MD5 | 92b4e7b917ea9e714c4375d35179501d |
| SHA1 | df4a2685da4e3bf2936472f649909febdd042238 |
| SHA256 | bd6c19f5ff52ddba237c164e678c25c33cc2c8d3339c89fcfd2aa5e5c7bfe796 |
| SHA512 | 0529932980a4ba9b087e97ff700567e0614da905d341b25d91f4396e2442a81f715d76dde78af63d5c9882c81f27300637bfbab0822428fced86d906b1466ff1 |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 630e76076618ed6d53016a3d4d1bba9e |
| SHA1 | b7fc3d244f094ed28df1377a31dc2bfd61549b3c |
| SHA256 | debfd4c8fab8a4ea2e5b70b992d7d647e0b20abf8b1f57b183baddb99e1dc544 |
| SHA512 | 8d0c4ad528fe6077625470606df3a7793a9bece7df0d2c1e032805c9e2a2b20ba62663c4cf91a6f84191816322a2e508b157eb4be295b23ed1798363b0801100 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-18 18:16
Reported
2024-08-18 18:16
Platform
win10v2004-20240802-en
Max time kernel
31s
Max time network
42s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4772 wrote to memory of 4472 | N/A | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 4772 wrote to memory of 4472 | N/A | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 4772 wrote to memory of 4472 | N/A | C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe
"C:\Users\Admin\AppData\Local\Temp\027b355ff9b7a02c415e2fd6ef55a2c07ba97fb543e9848b44fbf5dff8b5dfc0.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.19.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 2ccdfbde0854295311e04da7faae2278 |
| SHA1 | 798bdc2f05da5807900a4517559aa3cbf5ef47c4 |
| SHA256 | 7b7ad20320a4a09461541d1d666a67e5c20f7c083e53f86ca6b9fac7d5bcdd72 |
| SHA512 | 43a9fd37c376f5d21490e2ba29dffc43296e940857e6cac629ecf971bb8a429c87d944b372dedc8f9e9c320aa23da831d7f12378e3cc6eef510eaf65cfa6a7fc |