Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 14:38

General

  • Target

    2570f2938a8accbc41424134e0347d45a8779b36fffdd8aa104f02cd3fe04a46N.exe

  • Size

    80KB

  • MD5

    c16fb9eb68e644392b469da041ce9d80

  • SHA1

    755b3886c9fdf506a95caa4be7029e2e734090ba

  • SHA256

    2570f2938a8accbc41424134e0347d45a8779b36fffdd8aa104f02cd3fe04a46

  • SHA512

    a112d0bd93ebaf47fb6922a7b6db5ffcf4ef8e3eaecb9899838baeac39094d90517ea10c5e8fe2d8b962ac7e9245e111515fec1eafe3e7e341060d78b65da525

  • SSDEEP

    768:3fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA6:3fbIvYvZEyFKF6N4yS+AQmZTl/5i

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2570f2938a8accbc41424134e0347d45a8779b36fffdd8aa104f02cd3fe04a46N.exe
    "C:\Users\Admin\AppData\Local\Temp\2570f2938a8accbc41424134e0347d45a8779b36fffdd8aa104f02cd3fe04a46N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    80KB

    MD5

    2d8d032e0998e05d22cd3169f038df3e

    SHA1

    cd711b88cd912a38a06c4beceee48197466e6857

    SHA256

    befe26bc33174f62838212a2e8426c1011e6a5201bd8461e88ec34ce9ec411fc

    SHA512

    71ec4997b1f3ec4aa9ce27a825459387a25a2ddc44ce5e187018de6602fe6112852888a77fa48761ff788b7a0d083f56849385811964a16a16be08ba6bf00eb1

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    80KB

    MD5

    fba539758a5097a451b8267e94064134

    SHA1

    f24b0327bf471d5dc41cff9039663f65428e2517

    SHA256

    bc5e5e18a5c1cbe27e73fd10303fd5c06b9e52f95f364787305aa9a394308d84

    SHA512

    4e70d2018e1d8b4b72eb82062c23b09086b027940ee1447870ff558e94438946090f0ac8b6cf402deabab4e2f0be88efa4d71b5f6fdb9ec3df09d3e61529d35a

  • C:\Windows\SysWOW64\omsecor.exe

    Filesize

    80KB

    MD5

    a1b6aac5bb7c4ec9216a35d7dd5dcdc4

    SHA1

    df1a49b3c4b29a1350362b3b6051e94275ed6e53

    SHA256

    96d789b1c48db1810aa04c1cb71330d307e99e280e5717f806b970c1683b2bc4

    SHA512

    2a307392dbd14543dd705a17b7c023f59e41bf26a9abafb60ef34e3adbf5fa89572004ce4c17538769920f1119c4de9885b87a46444199945c462464d0e72c65