Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 08:18
Behavioral task
behavioral1
Sample
f83fcf0ae931037ba2da178f80abcea0N.exe
Resource
win7-20240708-en
General
-
Target
f83fcf0ae931037ba2da178f80abcea0N.exe
-
Size
248KB
-
MD5
f83fcf0ae931037ba2da178f80abcea0
-
SHA1
12010e310590cc7011f0c34f29b73afaeb5a2f43
-
SHA256
45b26778617e32b7a051224072b3c9488cd4ee1d73d121e59ef2c302c19cb756
-
SHA512
5bc99012fb69f2926f93312d2110f2d57af8cafa007b7e3911a6b7eeb672b3afab9b7fdb6c0c86e38b44a6863dc5eb685f91176aa846978221ad50d4591988aa
-
SSDEEP
1536:44d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:4IdseIO+EZEyFjEOFqTiQmGnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2140 omsecor.exe 676 omsecor.exe 1960 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
f83fcf0ae931037ba2da178f80abcea0N.exeomsecor.exeomsecor.exepid process 2524 f83fcf0ae931037ba2da178f80abcea0N.exe 2524 f83fcf0ae931037ba2da178f80abcea0N.exe 2140 omsecor.exe 2140 omsecor.exe 676 omsecor.exe 676 omsecor.exe -
Processes:
resource yara_rule behavioral1/memory/2524-0-0x0000000000400000-0x000000000043E000-memory.dmp upx \Users\Admin\AppData\Roaming\omsecor.exe upx behavioral1/memory/2140-9-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2524-11-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2140-12-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2140-17-0x00000000005D0000-0x000000000060E000-memory.dmp upx \Windows\SysWOW64\omsecor.exe upx behavioral1/memory/1960-37-0x0000000000400000-0x000000000043E000-memory.dmp upx C:\Users\Admin\AppData\Roaming\omsecor.exe upx behavioral1/memory/676-34-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/676-25-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2140-24-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
omsecor.exeomsecor.exef83fcf0ae931037ba2da178f80abcea0N.exeomsecor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f83fcf0ae931037ba2da178f80abcea0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f83fcf0ae931037ba2da178f80abcea0N.exeomsecor.exeomsecor.exedescription pid process target process PID 2524 wrote to memory of 2140 2524 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 2524 wrote to memory of 2140 2524 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 2524 wrote to memory of 2140 2524 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 2524 wrote to memory of 2140 2524 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 2140 wrote to memory of 676 2140 omsecor.exe omsecor.exe PID 2140 wrote to memory of 676 2140 omsecor.exe omsecor.exe PID 2140 wrote to memory of 676 2140 omsecor.exe omsecor.exe PID 2140 wrote to memory of 676 2140 omsecor.exe omsecor.exe PID 676 wrote to memory of 1960 676 omsecor.exe omsecor.exe PID 676 wrote to memory of 1960 676 omsecor.exe omsecor.exe PID 676 wrote to memory of 1960 676 omsecor.exe omsecor.exe PID 676 wrote to memory of 1960 676 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83fcf0ae931037ba2da178f80abcea0N.exe"C:\Users\Admin\AppData\Local\Temp\f83fcf0ae931037ba2da178f80abcea0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5b9876abae545d9dad7ebbb915498249a
SHA1001e97b2faa97aff156c5056914398a40cb73b2e
SHA256ad0289b69f216722a42e3f13723127fc7db9af8e9a1733b7b7c994d17602b778
SHA512ca6e1d7ac2f4dd11fd74253a774b48a45274627c30826ae01a7a7991db93676f35a73e65f5b9509abc913d0b6bee75577f51230c3b4c7864814805bc3ea7d11c
-
Filesize
248KB
MD52a4dad62c7d50a4c571623ebc0ebe7a2
SHA10ac27eb9014a677d4f9e2437348d3407fc07cb69
SHA256351f944b148816f75f3320e12eea4d276513662cb76c06e783c52c7a5ce58be6
SHA512525da0872fd472e296cfc49350927273b706cf131ab05d53a9a3b0d6795c48f62b9dd23ca9ef8f5c1328a037860e488cb864082ad44a1b482fd1ba93b8c6068e
-
Filesize
248KB
MD5f3278d913cb85c0334d6732b7da9f210
SHA1c1228dd98d1aa4e07c7e32d8da483a751e4e5fb0
SHA2568d2bfe642d721a4ceba9b47e00c33ed640e07bafd75377b5b3fb947912d9efdb
SHA51274df2068ca5e5b28c9811553a409ec2c12efa4261cba94dec83e996079858cf26cdf858540139bbbba58236d273985334156d56089c22884c04e3f768f439bf8