Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 15:17

General

  • Target

    1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe

  • Size

    64KB

  • MD5

    1c00754a0728f9946163179cd190a080

  • SHA1

    0504aceeeb0b1222f75812d2c249c760d88d9057

  • SHA256

    1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68f

  • SHA512

    ed35381ab962862d60a038c284311275e04ccb552212e35902d2f0e7384313077d072e986689003d37141891ebd3e7740c16119780ed8b36980228e919891894

  • SSDEEP

    768:vMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:vbIvYvZEyFKF6N4yS+AQmZcl/5

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    64KB

    MD5

    f586ef171233b30b9ac0f02ada39fbda

    SHA1

    4ed27f06ece9fc0dc5155cc0a4829b58f528801f

    SHA256

    4a7edcd4104679f56d3ffce668750abae64a329b3d75e1685f41f0632b7af397

    SHA512

    651c50c5848c201d48a2914fd4554a270e1895414ca529b04ec69e2b5b75aae759f1090d7671157ffdb13c3aaa6e6dcc3d2dc16284594c9a034e3d8b1dad0f87

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    64KB

    MD5

    49b5b6235cc0f39fdc386f5a1bb4554e

    SHA1

    fa7bbf1e776e6be7d49b468f572e146e6c6629c6

    SHA256

    801c01d0dd0caf8742bb80a9a7c300ccb5428268292bfa14818f51855847336b

    SHA512

    e734d69d422f50157b4e218172c2a6b407c6d5349f57bfd99642d4c1b5688d0e1f016d485f22b6fcd289f2160126ec6973181d21a3064ec13f8e3512be32b684

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    64KB

    MD5

    0de52a1b380b6460ab675f1b06bb6421

    SHA1

    86e8951afcc24e9ff163eb895e04214f99e24a4c

    SHA256

    7fdbf3dbb145009668c993a1bd5d6be050d56fad623faff081129e2d5d133359

    SHA512

    43b0f4e1e38b46eef154bc6d8f623f236bf385ba479fda184f9b95b1b8509a97bff308d9e384aed5808967bb42be75f0529578a752b4ee938dfa14e5842aac8e