Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2024 12:14
Behavioral task
behavioral1
Sample
2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe
Resource
win7-20240903-en
General
-
Target
2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe
-
Size
80KB
-
MD5
6fb1b6705c3446294b6ec21dd1fffb1b
-
SHA1
a513dd2087a1c6c61941f9ed92a8911d8e66d7ff
-
SHA256
2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92
-
SHA512
392665212563132805cacc8b2794040c77d9ed8dd615868fab326d5f88c3b59b10276d9a9d4b8e103d3547131a90f5f899a331a8a0958a5d9cda15a8837930b0
-
SSDEEP
768:FfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA6:FfbIvYvZEyFKF6N4yS+AQmZTl/5i
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 2 IoCs
pid Process 664 omsecor.exe 4660 omsecor.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe File opened for modification C:\Windows\SysWOW64\merocz.xc6 omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 772 wrote to memory of 664 772 2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe 82 PID 772 wrote to memory of 664 772 2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe 82 PID 772 wrote to memory of 664 772 2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe 82 PID 664 wrote to memory of 4660 664 omsecor.exe 92 PID 664 wrote to memory of 4660 664 omsecor.exe 92 PID 664 wrote to memory of 4660 664 omsecor.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe"C:\Users\Admin\AppData\Local\Temp\2944d44ccb1c0787f231269258c57e27b42efd654428a192277916a819ff8c92.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5ff02a1bdce2b60d2945a29f20f89c65e
SHA172bdb4e9f38bdd60da1a4b2b6d2b87ffe35844ac
SHA25657bb630e19ca458cf93459ce45b4edaebb960c5c916333011c0d575c43533f53
SHA5121a6d745211654ed40b7b6225ede17bcf1c06f5ede874ad3decb6771692c840ad00a903bde746d833c87495a03056e76320c16933bea5d48b9a394ce44f07854c
-
Filesize
80KB
MD559d912f88c8f71ddb23215c202f6aa2e
SHA14617fa1fc59fa052d666c262eb84b40ef0b3a626
SHA2569067402691b89594357e2bc60a4bb5e0d813c7d2980e81d3b5212c198f261ec3
SHA51255b0108faec9e7d56f7887ee53f82a94a9e01fdff45280297cec6f000eecdd5b3708c58a87b3769bbe4365dda20a2186b30b86869a67dfdb5942a7dd77db46f7