Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe
Resource
win7-20241023-en
General
-
Target
df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe
-
Size
96KB
-
MD5
73ca9a3ec1d1f5042be522712a9096b0
-
SHA1
2aa3b4289e28c1f855059f4842203d9d26f7dffd
-
SHA256
df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5b
-
SHA512
93c892d260b0e3dfb58e8459b3e5215d5a5ac5efd4066a59f62b67e4ec6c7152b2e879cc9722c2dadf0498ddc79546badd52b90bb1828a2488f99f54bc5ccb64
-
SSDEEP
1536:ynAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:yGs8cd8eXlYairZYqMddH13z
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 6 IoCs
pid Process 1236 omsecor.exe 1188 omsecor.exe 332 omsecor.exe 2104 omsecor.exe 836 omsecor.exe 2956 omsecor.exe -
Loads dropped DLL 7 IoCs
pid Process 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 1236 omsecor.exe 1188 omsecor.exe 1188 omsecor.exe 2104 omsecor.exe 2104 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1968 set thread context of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1236 set thread context of 1188 1236 omsecor.exe 32 PID 332 set thread context of 2104 332 omsecor.exe 36 PID 836 set thread context of 2956 836 omsecor.exe 38 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 1968 wrote to memory of 800 1968 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 30 PID 800 wrote to memory of 1236 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 31 PID 800 wrote to memory of 1236 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 31 PID 800 wrote to memory of 1236 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 31 PID 800 wrote to memory of 1236 800 df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe 31 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1236 wrote to memory of 1188 1236 omsecor.exe 32 PID 1188 wrote to memory of 332 1188 omsecor.exe 35 PID 1188 wrote to memory of 332 1188 omsecor.exe 35 PID 1188 wrote to memory of 332 1188 omsecor.exe 35 PID 1188 wrote to memory of 332 1188 omsecor.exe 35 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 332 wrote to memory of 2104 332 omsecor.exe 36 PID 2104 wrote to memory of 836 2104 omsecor.exe 37 PID 2104 wrote to memory of 836 2104 omsecor.exe 37 PID 2104 wrote to memory of 836 2104 omsecor.exe 37 PID 2104 wrote to memory of 836 2104 omsecor.exe 37 PID 836 wrote to memory of 2956 836 omsecor.exe 38 PID 836 wrote to memory of 2956 836 omsecor.exe 38 PID 836 wrote to memory of 2956 836 omsecor.exe 38 PID 836 wrote to memory of 2956 836 omsecor.exe 38 PID 836 wrote to memory of 2956 836 omsecor.exe 38 PID 836 wrote to memory of 2956 836 omsecor.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe"C:\Users\Admin\AppData\Local\Temp\df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exeC:\Users\Admin\AppData\Local\Temp\df08662b8426f1582302f90c28fcb69dd70f8c8301eedcc9f2006209d1c62d5bN.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD59c456389361b809a7e8f54793957d88c
SHA1d5819e8466b7f87d810c8c345e1e1998f6acde8a
SHA256836607cd4f16d0054f2d135ae4fafef4f3049ac598f2ef1e165fdf8fb3c7db21
SHA51266a64e6e2a42bb03a2e4fe46c335b2522fba802df827c2bfdcfcccdde72eb7d08410044d518be75a45bc2b35da9b30097b4df9bf9040f4d13d6159f49528d694
-
Filesize
96KB
MD5d99849a612bb9669c207757a60970159
SHA14631fad6508c8c6d607a589d900ef4f86a4803ff
SHA256fdcd5eb228f665237a46682956420ee5de296341850582a872b9f1f175b82d69
SHA5124c5068abb20505026a0d5bd2fb54bfab7531b8f5502c601ba111ca5568e524461cc99c16a95f0f87885bf3b958c71d62028cd6de5657f11c74a04e8bd9da98b5
-
Filesize
96KB
MD5cb39e7eaa053eea18755fd5bc30bc156
SHA12caaf7399f5f8e57231b04e92f5f5b960a84ff61
SHA2562ed8e80dba41f0cbc3e2465daad0e84bd2469565a19ee06fadf955f83d71a2d3
SHA51232c106ff5a1d1c514585b5d349595f5a93fdf5b14104234076f87961a89701890301ad57f54bf1ee3047a2cc5415fb1d70346cf7870a4c46f1abe91402acf9a1