Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 02:53
Behavioral task
behavioral1
Sample
42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe
Resource
win7-20241010-en
General
-
Target
42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe
-
Size
88KB
-
MD5
ad189b1ecc0e43a88777dd208ccadb50
-
SHA1
eed594eb3de0728dbc2b4697478eb67e27c6217a
-
SHA256
42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037
-
SHA512
2e4353eb883bc23d3b0b1852234ca01d001e5a54a3b07a8be569209903767d663f77f4f81abfe8bb98fbf32aa282c5d6bcf3607c7867ce4e1959036f83380bf4
-
SSDEEP
1536:1d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5R:9dseIOMEZEyFjEOFqTiQm5l/5R
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 2732 omsecor.exe 2592 omsecor.exe 2908 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 2732 omsecor.exe 2732 omsecor.exe 2592 omsecor.exe 2592 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2732 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 30 PID 2128 wrote to memory of 2732 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 30 PID 2128 wrote to memory of 2732 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 30 PID 2128 wrote to memory of 2732 2128 42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe 30 PID 2732 wrote to memory of 2592 2732 omsecor.exe 32 PID 2732 wrote to memory of 2592 2732 omsecor.exe 32 PID 2732 wrote to memory of 2592 2732 omsecor.exe 32 PID 2732 wrote to memory of 2592 2732 omsecor.exe 32 PID 2592 wrote to memory of 2908 2592 omsecor.exe 33 PID 2592 wrote to memory of 2908 2592 omsecor.exe 33 PID 2592 wrote to memory of 2908 2592 omsecor.exe 33 PID 2592 wrote to memory of 2908 2592 omsecor.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe"C:\Users\Admin\AppData\Local\Temp\42df003a9d56c1271b060686c57443beeca03aeb90f6f34185cbacadfca09037N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5fa71d1d07e3c0f6f61074e8264242f81
SHA1a4dd38decd0219b81a8c7004224938b759acdac2
SHA256b757e90d0fd4606555ea021eccb65449439e435f2065eb63d604605b6c700985
SHA5125cdec690802dcb863a7463a5be0958b0665f8a6f3959aa0e793ba82560dbf058ff4e664832a3becf66c22576439f755e44a1d88c88d161fc53f27dc02ed84426
-
Filesize
88KB
MD55174fe863e77c755992b3b3fcdab6913
SHA19677d1f4d135cfb4afe62df1f78a93cd141976c0
SHA256fe0af93a0e893ee8aad9e3956e858e8a367955c30266c64720dbddbced30d90b
SHA512fed5c2eb37ad03025e0cb4ac6ad609725db7ebd0317b7ba48f651aa064c34ef14d0e955d75c8440fcdf34eb5e9c763c62ca5488ac563085da4e4cccf0d355409
-
Filesize
88KB
MD58d899ec65b90c4fabe0a10cb03a848fa
SHA17384a49eccc5c714effa05ed0c69df359ac19927
SHA256c3308c3a29a878e9562def1dd08e654cee02cf38df0e6a45ec645ce9745a79db
SHA5128eb5e0e6e88129ff0fbf342b16215c86b007b38267fc535b0d72106c38d20b4e070b073466cd9627a646bf0f09de29b6297c3c5700def8172ad8644458f679c2