Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 08:18
Behavioral task
behavioral1
Sample
f83fcf0ae931037ba2da178f80abcea0N.exe
Resource
win7-20240708-en
General
-
Target
f83fcf0ae931037ba2da178f80abcea0N.exe
-
Size
248KB
-
MD5
f83fcf0ae931037ba2da178f80abcea0
-
SHA1
12010e310590cc7011f0c34f29b73afaeb5a2f43
-
SHA256
45b26778617e32b7a051224072b3c9488cd4ee1d73d121e59ef2c302c19cb756
-
SHA512
5bc99012fb69f2926f93312d2110f2d57af8cafa007b7e3911a6b7eeb672b3afab9b7fdb6c0c86e38b44a6863dc5eb685f91176aa846978221ad50d4591988aa
-
SSDEEP
1536:44d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:4IdseIO+EZEyFjEOFqTiQmGnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2984 omsecor.exe 864 omsecor.exe 1412 omsecor.exe -
Processes:
resource yara_rule behavioral2/memory/864-0-0x0000000000400000-0x000000000043E000-memory.dmp upx C:\Users\Admin\AppData\Roaming\omsecor.exe upx behavioral2/memory/2984-5-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/864-6-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2984-7-0x0000000000400000-0x000000000043E000-memory.dmp upx C:\Windows\SysWOW64\omsecor.exe upx behavioral2/memory/864-11-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2984-13-0x0000000000400000-0x000000000043E000-memory.dmp upx C:\Users\Admin\AppData\Roaming\omsecor.exe upx behavioral2/memory/864-17-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1412-18-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1412-20-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
omsecor.exef83fcf0ae931037ba2da178f80abcea0N.exeomsecor.exeomsecor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f83fcf0ae931037ba2da178f80abcea0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f83fcf0ae931037ba2da178f80abcea0N.exeomsecor.exeomsecor.exedescription pid process target process PID 864 wrote to memory of 2984 864 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 864 wrote to memory of 2984 864 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 864 wrote to memory of 2984 864 f83fcf0ae931037ba2da178f80abcea0N.exe omsecor.exe PID 2984 wrote to memory of 864 2984 omsecor.exe omsecor.exe PID 2984 wrote to memory of 864 2984 omsecor.exe omsecor.exe PID 2984 wrote to memory of 864 2984 omsecor.exe omsecor.exe PID 864 wrote to memory of 1412 864 omsecor.exe omsecor.exe PID 864 wrote to memory of 1412 864 omsecor.exe omsecor.exe PID 864 wrote to memory of 1412 864 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83fcf0ae931037ba2da178f80abcea0N.exe"C:\Users\Admin\AppData\Local\Temp\f83fcf0ae931037ba2da178f80abcea0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5e6a3890489b535fe43e01e9060f4c597
SHA1b5c6267c87beb1ab22b18f6461424abd113e3b40
SHA256564fa955eb1a866e1b55140fbbe9708542d747a4f85a8f3fb35b9dafc6e39b11
SHA512b885f43c6846fbad22561c731a31dbcfaff5dfa8a4d183896aeda249884cbcbdc7eea270fdf3a46c97e6f0950b0661b101067e2fb214b7ed516a81d861fd9a0f
-
Filesize
248KB
MD52a4dad62c7d50a4c571623ebc0ebe7a2
SHA10ac27eb9014a677d4f9e2437348d3407fc07cb69
SHA256351f944b148816f75f3320e12eea4d276513662cb76c06e783c52c7a5ce58be6
SHA512525da0872fd472e296cfc49350927273b706cf131ab05d53a9a3b0d6795c48f62b9dd23ca9ef8f5c1328a037860e488cb864082ad44a1b482fd1ba93b8c6068e
-
Filesize
248KB
MD5ac3990b7ec718f172ae5cf1d180d3f8b
SHA1c00800330d39ad4d2a4af8ee9db1751f43852153
SHA256c61a29206b8ba984031334403b20b6e134fba658ef67a363abd7a5b772f1f2a7
SHA512bbc57865a45a964aed01c03f67d34d38afb7bd250117a47ec9d6c9956e7ff82e2c77e23b359e894ed6282fe04a7c0ba80a53b062f630788d8df0f1c50d9e8f73