Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:41
Behavioral task
behavioral1
Sample
623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Resource
win7-20240903-en
General
-
Target
623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
-
Size
71KB
-
MD5
2304f8a81adeb321a98aad88eb540694
-
SHA1
982834579ead861d2a40a1b8aa1dc03acd496fb0
-
SHA256
623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8
-
SHA512
13cca69b385494b10d5fd1215de1176482b1472f8c6ecb8ef3ebd130beffcc70ab7e870a55797d08de70d6966e53857b96da8659ebfa1b2ff41c0e68efdab847
-
SSDEEP
1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH/:kdseIOMEZEyFjEOFqTiQmQDHIbH/
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 2776 omsecor.exe 1692 omsecor.exe 1748 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 2776 omsecor.exe 2776 omsecor.exe 1692 omsecor.exe 1692 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2776 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 30 PID 2076 wrote to memory of 2776 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 30 PID 2076 wrote to memory of 2776 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 30 PID 2076 wrote to memory of 2776 2076 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe 30 PID 2776 wrote to memory of 1692 2776 omsecor.exe 32 PID 2776 wrote to memory of 1692 2776 omsecor.exe 32 PID 2776 wrote to memory of 1692 2776 omsecor.exe 32 PID 2776 wrote to memory of 1692 2776 omsecor.exe 32 PID 1692 wrote to memory of 1748 1692 omsecor.exe 33 PID 1692 wrote to memory of 1748 1692 omsecor.exe 33 PID 1692 wrote to memory of 1748 1692 omsecor.exe 33 PID 1692 wrote to memory of 1748 1692 omsecor.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD57e7609f784087520d682a9eba366dab8
SHA1f77b7b31cd9a716f0e448c006d9e51628a392c60
SHA25677ff00f5530ee100454c15c431075d0c3794f38d6a647a7dcfefc106e2e7845a
SHA5124f7737b1fd47cfa844acb70294a72cb3dc15de58a907165136c324e308441f1a78fb6442b7a5062e68e0b3f0d0024a5a0bf6a226758febb68f1c0a3870ad16ef
-
Filesize
71KB
MD569924c76321ce1347675a071b75826b0
SHA1fd10596b96d44a1b0a85f8233ca0c890f02ec74a
SHA25640c488baedc93b02b0eef845272500621c2af17092e0a4436c14bdef78e87ef1
SHA5125c7e7fcd53f50a37e099a680f1d9b02959bb721275c2c95a49ecd1cf62356dd52f0fc66b6061a47490f144ec091c8fa739469293f3c053f6c43355f679f9b67a
-
Filesize
71KB
MD51219dcc242840afc026303493f928d41
SHA1f628333e63a080dc66f9faacd646e78890527b82
SHA2562458c5fd589111df0568226c1087d4cdcdbd5b29d0f0ceb27e116195f22f541c
SHA51214eaa4f7b08e95b9cafe84db8607a7041fba8486580e9b4f06368a985c4d55f3fd588bb3a91c0e0fa15935d20fc09091bf58b28a667a1c6c78b1ff2a2dbf76d1