Analysis

  • max time kernel
    120s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 06:14

General

  • Target

    c95e67da84009169ba495d2dc2e240c0N.exe

  • Size

    341KB

  • MD5

    c95e67da84009169ba495d2dc2e240c0

  • SHA1

    bca9ecaf698a0fda36531539b79b0f03a3f2795e

  • SHA256

    88cd1d88dcaa57d9679b7a55eca807b8630f6a31d1128e3ff1efccab5c16bb5c

  • SHA512

    162b5097c407746d61c1c754054bdba27cf6e0cdaca314685f833ccefaba5216611ffcffb5d4798776b871cde6cbbc4010cdadf3efa43a63a3e89d93b9b935f5

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZj524k2DgvyHA:/n8yN0Mr8ZFGwov

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3716
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
        "C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
            "C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1808
              • C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe
                "C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2672
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4468
                  • C:\Windows\SysWOW64\omsecor.exe
                    C:\Windows\System32\omsecor.exe
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3808
                    • C:\Users\Admin\AppData\Roaming\omsecor.exe
                      C:\Users\Admin\AppData\Roaming\omsecor.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

    Filesize

    737KB

    MD5

    e9bd2d1d0c612ef4375fdec99b526282

    SHA1

    a2d836daf8fe264a0e5e07d2fa4f350a025b751d

    SHA256

    4154b4494a5542dee7924a9ddacee0fcb3aaf2532d2c675c14e494993e06493b

    SHA512

    628504edade4b608d36eded95381c02ce7c81203b0adc67e9788c5b5c9b54c4a735e0efad4c399c6ab54ea446c33dfbe44441eac9b5f3a370be6a7aab3146d32

  • C:\Users\Admin\AppData\Local\Temp\c95e67da84009169ba495d2dc2e240c0N.exe

    Filesize

    35KB

    MD5

    50fe69e9c49802d005038522f81e9b06

    SHA1

    276d8f126ebe06549320d7e324f9e105222d209c

    SHA256

    72f771647913744c8d3fa98f345b883cfe62ac773363e56d4d08f66fbf0a00db

    SHA512

    17f6065960e7e54ef24ed2f4f82cd0f92d65aba0aaaac409dbba5b5a9802d7f604a8d4a40e24e1481cbcc5338ccb26b7fea171f2892e4cd1a02fd5b44bb1a7b2

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    67b56a5fecd2e6a6598c5d36ba8a40d5

    SHA1

    dd868ba6efb13ff044dee1b5f78d6966d63f7422

    SHA256

    c95a8282e4d1c03e38b530ee82a7d761f7091e2edc91c77fc943e955e442610e

    SHA512

    6df322eccbe17d29388215a7ca49edc1047c97ffe006b1e5f47b05554070bb9e01dff131bdd13e16059d7eb55d6c18628f9639b5faf63c08ce23571b317658ba

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    eb3067223b4757bf1b5625b42bae143f

    SHA1

    8af5f650e7e3cd05fa02b4ab48d48fd3bde187d7

    SHA256

    16f8f0613d5e0189bc968c4f04c8da809d6ed4b6f38da07a7fb7c9655280288c

    SHA512

    ed2c615adad78f09ed2e8a5125c5072de3433e47e697ab7c51d3d28e78fcaac7f4459d48cd1f7459c71adeffdeb53b901c7558e848836d6bb0e91e729e51fef7

  • C:\Users\Public\Microsoft Build\Isass.exe

    Filesize

    261KB

    MD5

    9ee3aea20fa8de7b19353aef20d64baf

    SHA1

    17926e9fd3e1f03574c94f94cdccd2845fb952a2

    SHA256

    c6deded1772c32340199c3affea29a61834c3bedf5ab7c5da19aa9ce42dae858

    SHA512

    4a1d96700f744752862370144b2f74123cef3ffe489a200354c7cd31e52052dcf53b2bea9aad067192fec5f9c610e023f69976768e9cd08b5b53dc5d5fbab767

  • C:\Windows\SysWOW64\omsecor.exe

    Filesize

    35KB

    MD5

    933a5e25533ef7178f519bde6a836ac5

    SHA1

    80302ecb5940a14030c57760a44baf3271dd143a

    SHA256

    876744e5adbe38d9dc8e20239166912add97f6c4ffbf4d8f003df1fc46cc9513

    SHA512

    c19e745e36750d8c351d1e666ab80e2f75731d0c264d051b481581a8c25f56747955f1787f506707ba1be0dc5ed196a6cd7c4f16aaf9588ddffa4acd0d8f9439

  • memory/1808-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2164-19-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2396-10-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2396-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2468-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2468-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2640-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2640-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2672-33-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/3716-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-57-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-34-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-87-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-85-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-39-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-41-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-78-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-46-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-5-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-7-0x0000000001C60000-0x0000000001C61000-memory.dmp

    Filesize

    4KB

  • memory/3716-59-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3716-66-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3808-76-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4468-60-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4468-67-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4468-71-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4468-47-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4468-36-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4944-86-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/4984-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/4984-6-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

    Filesize

    4KB

  • memory/4984-1-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB