Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/12/2024, 22:06
Behavioral task
behavioral1
Sample
521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe
Resource
win7-20241010-en
General
-
Target
521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe
-
Size
61KB
-
MD5
587f1c746ca05559da45ca63829d112d
-
SHA1
879d27fad040dd1aacfe9ba47ea83bc73316e284
-
SHA256
521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16
-
SHA512
4692c21f0b55a04460245e3caebee339e736b258b3207cdc98c1d6e6fe80e9296fdd143a17bcc73da584a06ac8a6403773cc83a8a220833c10313b1c23f9c08d
-
SSDEEP
1536:Fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ4l/5N:tdseIOMEZEyFjEOFqTiQmil/5N
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 1668 omsecor.exe 2112 omsecor.exe 2824 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 1668 omsecor.exe 1668 omsecor.exe 2112 omsecor.exe 2112 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1668 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 31 PID 1832 wrote to memory of 1668 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 31 PID 1832 wrote to memory of 1668 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 31 PID 1832 wrote to memory of 1668 1832 521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe 31 PID 1668 wrote to memory of 2112 1668 omsecor.exe 33 PID 1668 wrote to memory of 2112 1668 omsecor.exe 33 PID 1668 wrote to memory of 2112 1668 omsecor.exe 33 PID 1668 wrote to memory of 2112 1668 omsecor.exe 33 PID 2112 wrote to memory of 2824 2112 omsecor.exe 34 PID 2112 wrote to memory of 2824 2112 omsecor.exe 34 PID 2112 wrote to memory of 2824 2112 omsecor.exe 34 PID 2112 wrote to memory of 2824 2112 omsecor.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe"C:\Users\Admin\AppData\Local\Temp\521e179d06bffe53e1e57b820782c0bb7f942d0e71f95a09bc7e77e4a9766c16.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5d30091f295418f77b653e358d229415e
SHA1314a990a5a3d2cc5f845d6ba7518fc2136d909d2
SHA2564c1cabdaf5306eec96a0828e4fda831be6ed18579e6ccfff29a3f1e476bccc69
SHA512039e4aaccf7a56ee00e8c04684d62353609628d499f6bddb059eb79bc940d50d9bde17a7260c1b21161333af0cfc689553cffd5ec08139be5341a31b6b810805
-
Filesize
61KB
MD5488ce35b81e383644ca2f347122461e7
SHA19cc7e3a331e0fe0c4c15cfb6fb87e718182ca457
SHA25698afafd1f386323c0dec1e408a012cd90a308bc0d4a744d076f9b9a4ead983c5
SHA512cb8ab10b6cebf54bf54e206c7efdd2d117747f640edfd941a0d74454bf5fb932cbb1b796ca89636687cb653132d550ecc2017922a2758322232afaf2f5773c4b
-
Filesize
61KB
MD595f101a3f4fc8f3d156c439f984c00f3
SHA1bf3a061ced90023ca1a85e7a7da93887c915e243
SHA25688540ed8d9d1bdb5c152cc31bd73d9a9c8299ff2053ad9cd7dfde7a15dba9d62
SHA512d6386080fb45ca488c84794189d6bcd5c07278e1db98df3707e55327db1803ab73f16e68da339da4aae044de649de59cf53d00532987bc9637e9f7db181964f8