Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/12/2024, 00:11
Behavioral task
behavioral1
Sample
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe
Resource
win7-20240903-en
General
-
Target
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe
-
Size
61KB
-
MD5
d1a84d884bbfaead7b91f455bd5a4b30
-
SHA1
a3fecc074bda03497901af4ca2f5aa2af7714bfb
-
SHA256
ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113b
-
SHA512
23fc7fc73ab018fc73da7afa0af24570c94d85d63f1ee02d4a6fe555ae30cb2f48f9cb7633742fe839fd3063d2305fb7df507406724cf0c9ae1d2583f7688a59
-
SSDEEP
1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ4l/5/:mdseIOMEZEyFjEOFqTiQmil/5/
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 1932 omsecor.exe 2008 omsecor.exe 2804 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 1932 omsecor.exe 1932 omsecor.exe 2008 omsecor.exe 2008 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1932 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 30 PID 2652 wrote to memory of 1932 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 30 PID 2652 wrote to memory of 1932 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 30 PID 2652 wrote to memory of 1932 2652 ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe 30 PID 1932 wrote to memory of 2008 1932 omsecor.exe 33 PID 1932 wrote to memory of 2008 1932 omsecor.exe 33 PID 1932 wrote to memory of 2008 1932 omsecor.exe 33 PID 1932 wrote to memory of 2008 1932 omsecor.exe 33 PID 2008 wrote to memory of 2804 2008 omsecor.exe 34 PID 2008 wrote to memory of 2804 2008 omsecor.exe 34 PID 2008 wrote to memory of 2804 2008 omsecor.exe 34 PID 2008 wrote to memory of 2804 2008 omsecor.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe"C:\Users\Admin\AppData\Local\Temp\ae5f6a956cafbc0a5fca0abc70bb68797e0551b78b70839a17e213816048113bN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD52ced7a116dd37692f9bcf3666b2dd31d
SHA1a79e80fc7fbfb7a0ba551fa8c294fab714d15507
SHA256911740e0319ce7f1a344d0ac5de89b8e270b5dff3d47b8de890287d95a51869e
SHA5126370ff041b47bc42264d38aa6d4096c402598c0a6ac1b595b8c9f8aff50588b5f0ee25f3030a21b073279e532c0f649175fc27a8ff49d9b72e50e9127585109b
-
Filesize
61KB
MD51dfa2b8f6ceaf5481ddeebf64065aa80
SHA12a78d6956fb473151caaf5d0ad8be34ee15bf0e7
SHA2561b03ca368e45d4244f0af844914591d3151fe7cd035ec01d9478666e67a63695
SHA5127dc32278959c480000f38274b7d99179d7b54963ffce627e41a9081c94c6f52c283c5e25236aba68c2bfdcedd03be145e2a0113bdef34629953fb8e944e446e2
-
Filesize
61KB
MD5063b5ba1014827bddcf6282382af4698
SHA1b65b2581cd73f5aa82579eb368fa7f83006a035c
SHA2567fa8d79455891c6f8d8f1d0f73b133e36aa3cdc2917bb038272e03df9b865b41
SHA512c85abab4c01387c830ee6bbcd24c46437934b973c377f63c7da46e5784244c272c2fa657a32150a56e2545f3f4436233f93409f5d2ff31fb69eb5c026250025d