Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 01:52
Behavioral task
behavioral1
Sample
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe
Resource
win7-20241023-en
General
-
Target
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe
-
Size
61KB
-
MD5
d1a84d884bbfaead7b91f455bd5a4b30
-
SHA1
a3fecc074bda03497901af4ca2f5aa2af7714bfb
-
SHA256
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b
-
SHA512
23fc7fc73ab018fc73da7afa0af24570c94d85d63f1ee02d4a6fe555ae30cb2f48f9cb7633742fe839fd3063d2305fb7df507406724cf0c9ae1d2583f7688a59
-
SSDEEP
1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ4l/5/:mdseIOMEZEyFjEOFqTiQmil/5/
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 2628 omsecor.exe 1972 omsecor.exe 3016 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 2628 omsecor.exe 2628 omsecor.exe 1972 omsecor.exe 1972 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2628 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 30 PID 2416 wrote to memory of 2628 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 30 PID 2416 wrote to memory of 2628 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 30 PID 2416 wrote to memory of 2628 2416 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe 30 PID 2628 wrote to memory of 1972 2628 omsecor.exe 33 PID 2628 wrote to memory of 1972 2628 omsecor.exe 33 PID 2628 wrote to memory of 1972 2628 omsecor.exe 33 PID 2628 wrote to memory of 1972 2628 omsecor.exe 33 PID 1972 wrote to memory of 3016 1972 omsecor.exe 34 PID 1972 wrote to memory of 3016 1972 omsecor.exe 34 PID 1972 wrote to memory of 3016 1972 omsecor.exe 34 PID 1972 wrote to memory of 3016 1972 omsecor.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe"C:\Users\Admin\AppData\Local\Temp\ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD51dfa2b8f6ceaf5481ddeebf64065aa80
SHA12a78d6956fb473151caaf5d0ad8be34ee15bf0e7
SHA2561b03ca368e45d4244f0af844914591d3151fe7cd035ec01d9478666e67a63695
SHA5127dc32278959c480000f38274b7d99179d7b54963ffce627e41a9081c94c6f52c283c5e25236aba68c2bfdcedd03be145e2a0113bdef34629953fb8e944e446e2
-
Filesize
61KB
MD5b48cc1d9a8f70404f3d3ed70dd10597d
SHA1e04be896c7e0bb40282a15efce2e4bad1a87098b
SHA25682a20ab0fc1165b45d650a228f7d15dd8cd900616de8d179dd1db961db55e034
SHA512a1118128c90f65caeb433563da0a7f8893e45804182a0f916b7a2bd90ca9f3ba27812f5bbc170bed68e781f62ac1596addd00401e90035d8d8908241a43e4b13
-
Filesize
61KB
MD5c2c75f4a46e3d556852a023d58f111d3
SHA1c80f7ffea7eb65e39a2789bae1417863ee101435
SHA2561e086d02d7ec324ad11f96fb07fe3645c3c11ab73e34a78f0ce2d6f9e8566b26
SHA51271b2ca185574ae9c1d20d0683a441bb669acb9b3e825701521e968704f38a9d1ca16a37e8f86367288f2ae9a7f2af9ae249f657ec75e5d1be45c3aa2b724a07e