Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 15:17
Behavioral task
behavioral1
Sample
1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
Resource
win7-20240903-en
General
-
Target
1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe
-
Size
64KB
-
MD5
1c00754a0728f9946163179cd190a080
-
SHA1
0504aceeeb0b1222f75812d2c249c760d88d9057
-
SHA256
1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68f
-
SHA512
ed35381ab962862d60a038c284311275e04ccb552212e35902d2f0e7384313077d072e986689003d37141891ebd3e7740c16119780ed8b36980228e919891894
-
SSDEEP
768:vMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:vbIvYvZEyFKF6N4yS+AQmZcl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 1864 omsecor.exe 572 omsecor.exe 1992 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 1864 omsecor.exe 1864 omsecor.exe 572 omsecor.exe 572 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1864 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 30 PID 2360 wrote to memory of 1864 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 30 PID 2360 wrote to memory of 1864 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 30 PID 2360 wrote to memory of 1864 2360 1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe 30 PID 1864 wrote to memory of 572 1864 omsecor.exe 33 PID 1864 wrote to memory of 572 1864 omsecor.exe 33 PID 1864 wrote to memory of 572 1864 omsecor.exe 33 PID 1864 wrote to memory of 572 1864 omsecor.exe 33 PID 572 wrote to memory of 1992 572 omsecor.exe 34 PID 572 wrote to memory of 1992 572 omsecor.exe 34 PID 572 wrote to memory of 1992 572 omsecor.exe 34 PID 572 wrote to memory of 1992 572 omsecor.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe"C:\Users\Admin\AppData\Local\Temp\1fd45a443ae2a089e0c9c0a35127ed652cb4dc89c8f891e9f7eb36b59513a68fN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f586ef171233b30b9ac0f02ada39fbda
SHA14ed27f06ece9fc0dc5155cc0a4829b58f528801f
SHA2564a7edcd4104679f56d3ffce668750abae64a329b3d75e1685f41f0632b7af397
SHA512651c50c5848c201d48a2914fd4554a270e1895414ca529b04ec69e2b5b75aae759f1090d7671157ffdb13c3aaa6e6dcc3d2dc16284594c9a034e3d8b1dad0f87
-
Filesize
64KB
MD549b5b6235cc0f39fdc386f5a1bb4554e
SHA1fa7bbf1e776e6be7d49b468f572e146e6c6629c6
SHA256801c01d0dd0caf8742bb80a9a7c300ccb5428268292bfa14818f51855847336b
SHA512e734d69d422f50157b4e218172c2a6b407c6d5349f57bfd99642d4c1b5688d0e1f016d485f22b6fcd289f2160126ec6973181d21a3064ec13f8e3512be32b684
-
Filesize
64KB
MD50de52a1b380b6460ab675f1b06bb6421
SHA186e8951afcc24e9ff163eb895e04214f99e24a4c
SHA2567fdbf3dbb145009668c993a1bd5d6be050d56fad623faff081129e2d5d133359
SHA51243b0f4e1e38b46eef154bc6d8f623f236bf385ba479fda184f9b95b1b8509a97bff308d9e384aed5808967bb42be75f0529578a752b4ee938dfa14e5842aac8e