Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 12:43
Behavioral task
behavioral1
Sample
a00fe3a2c55cd63807c35ccf89171830N.exe
Resource
win7-20240704-en
General
-
Target
a00fe3a2c55cd63807c35ccf89171830N.exe
-
Size
35KB
-
MD5
a00fe3a2c55cd63807c35ccf89171830
-
SHA1
cf1ae9ff4aad8776d068fd982d1faf35c84dee30
-
SHA256
06d6b7a7a3a0e29902f581826dc400375327c0737f12e6c7155c6fdde56373a1
-
SHA512
5b13d2cac4bd217bb937c026343285a679406b709f18c1e3aba27a8d5bfb4270b17179359dc4b7b575fd944b52985b45fc7590942f4ce04ff87a16eded1592be
-
SSDEEP
768:A6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:X8Z0kA7FHlO2OwOTUtKjpB
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2776 omsecor.exe 992 omsecor.exe 680 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
a00fe3a2c55cd63807c35ccf89171830N.exeomsecor.exeomsecor.exepid process 2796 a00fe3a2c55cd63807c35ccf89171830N.exe 2796 a00fe3a2c55cd63807c35ccf89171830N.exe 2776 omsecor.exe 2776 omsecor.exe 992 omsecor.exe 992 omsecor.exe -
Processes:
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2796-4-0x0000000000220000-0x000000000024D000-memory.dmp upx \Users\Admin\AppData\Roaming\omsecor.exe upx behavioral1/memory/2796-11-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2776-13-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2776-16-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2776-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2776-22-0x0000000000400000-0x000000000042D000-memory.dmp upx \Windows\SysWOW64\omsecor.exe upx behavioral1/memory/2776-33-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/992-35-0x0000000000400000-0x000000000042D000-memory.dmp upx \Users\Admin\AppData\Roaming\omsecor.exe upx behavioral1/memory/680-47-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/992-45-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/680-49-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a00fe3a2c55cd63807c35ccf89171830N.exeomsecor.exeomsecor.exeomsecor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a00fe3a2c55cd63807c35ccf89171830N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a00fe3a2c55cd63807c35ccf89171830N.exeomsecor.exeomsecor.exedescription pid process target process PID 2796 wrote to memory of 2776 2796 a00fe3a2c55cd63807c35ccf89171830N.exe omsecor.exe PID 2796 wrote to memory of 2776 2796 a00fe3a2c55cd63807c35ccf89171830N.exe omsecor.exe PID 2796 wrote to memory of 2776 2796 a00fe3a2c55cd63807c35ccf89171830N.exe omsecor.exe PID 2796 wrote to memory of 2776 2796 a00fe3a2c55cd63807c35ccf89171830N.exe omsecor.exe PID 2776 wrote to memory of 992 2776 omsecor.exe omsecor.exe PID 2776 wrote to memory of 992 2776 omsecor.exe omsecor.exe PID 2776 wrote to memory of 992 2776 omsecor.exe omsecor.exe PID 2776 wrote to memory of 992 2776 omsecor.exe omsecor.exe PID 992 wrote to memory of 680 992 omsecor.exe omsecor.exe PID 992 wrote to memory of 680 992 omsecor.exe omsecor.exe PID 992 wrote to memory of 680 992 omsecor.exe omsecor.exe PID 992 wrote to memory of 680 992 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00fe3a2c55cd63807c35ccf89171830N.exe"C:\Users\Admin\AppData\Local\Temp\a00fe3a2c55cd63807c35ccf89171830N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:680
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5bb782486b12b057300bc6245995d6649
SHA1a51d6bd1925b7ceed4f312923b89b7af6b6c82e2
SHA2564023c822a006be70851c316d090eee3f3c51abc1575d4ea944c1fecc6ead86fd
SHA512d08a28c6b8e3c66aa687ccd4093137345e8f34c7d442adb13350d6ffbee99b11e0835f1df678385a8e816d990ac6b92ee05f1de3048047df90fe1b3a1cdb0b08
-
Filesize
35KB
MD5b40ac8124b8a5210400154bbebf6fcc7
SHA1d4b57b6b5906ab7f48d904e160cbfc691efafb7d
SHA256719442bf2f0f25bbb3abf9bff516804d0d9d062362e7439c5df68bf4ebc52e2e
SHA512011418046beb7d2754d1cf2a9f617bc4b2ba9f105a01de1c7296be3737c39c5f066e69251f5e8d1daf8dc185d74e9d8f07a1a05961bb6cafb9d1efa70e3c0db1
-
Filesize
35KB
MD5390e72c71ffcc0e42023f38bf000df78
SHA14c076ac741c9af64adc727e3eb3a50e48d5b792b
SHA256160c3f1642db81de6104a9c9fa07cfa3adaabe68c1dd95c1c7f2de72d6a623f5
SHA512c7f26bfa1cc67a8c6732c0ceaa3fa0c577fb227c100ca20a1525f5f9f976eb6455a0a65f3f4dbaefb6c41cd672e1410f10f3041c690bf74d544cf3b8a4f0694e