Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 14:36
Behavioral task
behavioral1
Sample
18ebd0527353cf5169a3d24557fab6f0N.exe
Resource
win7-20240704-en
General
-
Target
18ebd0527353cf5169a3d24557fab6f0N.exe
-
Size
248KB
-
MD5
18ebd0527353cf5169a3d24557fab6f0
-
SHA1
71153bc6ab1076414913be32badef73c80a04682
-
SHA256
714b78c2eb5e85b67398800aa5bc12d0a99ce67effb3b7f83494e395d8909f27
-
SHA512
2e81e96e2906abd2c02c66366b42692cc70c1b9e67e2b97584fe12ca1a33d55184116b80da8c9441cc25115c9004493fa626108268c965832dbd410e53abf2ea
-
SSDEEP
1536:84d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:8IdseIO+EZEyFjEOFqTiQmGnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
omsecor.exeomsecor.exepid process 2640 omsecor.exe 1556 omsecor.exe -
Loads dropped DLL 4 IoCs
Processes:
18ebd0527353cf5169a3d24557fab6f0N.exeomsecor.exepid process 2060 18ebd0527353cf5169a3d24557fab6f0N.exe 2060 18ebd0527353cf5169a3d24557fab6f0N.exe 2640 omsecor.exe 2640 omsecor.exe -
Processes:
resource yara_rule behavioral1/memory/2060-1-0x0000000000400000-0x000000000043E000-memory.dmp upx \Users\Admin\AppData\Roaming\omsecor.exe upx behavioral1/memory/2640-11-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2060-8-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2640-12-0x0000000000400000-0x000000000043E000-memory.dmp upx \Windows\SysWOW64\omsecor.exe upx behavioral1/memory/2640-17-0x0000000000310000-0x000000000034E000-memory.dmp upx behavioral1/memory/2640-23-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1556-25-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1556-27-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
omsecor.exeomsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe File opened for modification C:\Windows\SysWOW64\merocz.xc6 omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
18ebd0527353cf5169a3d24557fab6f0N.exeomsecor.exeomsecor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ebd0527353cf5169a3d24557fab6f0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
18ebd0527353cf5169a3d24557fab6f0N.exeomsecor.exedescription pid process target process PID 2060 wrote to memory of 2640 2060 18ebd0527353cf5169a3d24557fab6f0N.exe omsecor.exe PID 2060 wrote to memory of 2640 2060 18ebd0527353cf5169a3d24557fab6f0N.exe omsecor.exe PID 2060 wrote to memory of 2640 2060 18ebd0527353cf5169a3d24557fab6f0N.exe omsecor.exe PID 2060 wrote to memory of 2640 2060 18ebd0527353cf5169a3d24557fab6f0N.exe omsecor.exe PID 2640 wrote to memory of 1556 2640 omsecor.exe omsecor.exe PID 2640 wrote to memory of 1556 2640 omsecor.exe omsecor.exe PID 2640 wrote to memory of 1556 2640 omsecor.exe omsecor.exe PID 2640 wrote to memory of 1556 2640 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18ebd0527353cf5169a3d24557fab6f0N.exe"C:\Users\Admin\AppData\Local\Temp\18ebd0527353cf5169a3d24557fab6f0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1556
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5c4c1a085ae4b3ac23a50d993cc6049d1
SHA101219d80f85571a02d005cc66b732a677403c292
SHA256023f22427e011c29c8808243c70ea746150038858cf53fe329b8fe68cc70732c
SHA51256b48f9e859dbb1c616efd97ea765dfbb55d509a5d686e542679ca1332e65e15c3cccfaa39f3f396f7d7415f1a36e890608ce0c39de379d86e8bab1090b3a668
-
Filesize
248KB
MD5112bf03733b42bc87b34ca1cb1d4a58b
SHA10b972985321ba8aed5df04805fc6123c781c5d8b
SHA256af809c561779e1a44c714a2945087946c03d5a466e1197db4ae56419f2ff8b51
SHA512462e0447900cf9079f06bb25abcce84872dfe52330dbdb8d72ed566f6849dedd1a8b696aa1db2cb4fbeaf3276692e12c99df39338b3f729498950a5e801e2507