Analysis
-
max time kernel
80s -
max time network
90s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
30/12/2024, 19:55
General
-
Target
97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe
-
Size
65KB
-
MD5
776343c921e3360282ec794ca27f70e0
-
SHA1
8f7c99f9c71d7444aa25af261bd0b17571b76127
-
SHA256
97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6e
-
SHA512
1a4023d9617fa52b54d1405a7790b57e197b6fb91489b698d50712d079766ec4e789351c27aee1adef26ee4ba701cfaea4a21faba9b0d1e7021a31ae32479307
-
SSDEEP
1536:Od9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:WdseIO+EZEyFjEOFqTiQmRHz
Malware Config
Extracted
Family
neconyd
C2
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 1 IoCs
pid Process 2552 omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2296 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5132 taskmgr.exe Token: SeSystemProfilePrivilege 5132 taskmgr.exe Token: SeCreateGlobalPrivilege 5132 taskmgr.exe Token: 33 5132 taskmgr.exe Token: SeIncBasePriorityPrivilege 5132 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe 5132 taskmgr.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2552 1880 97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe 83 PID 1880 wrote to memory of 2552 1880 97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe 83 PID 1880 wrote to memory of 2552 1880 97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe"C:\Users\Admin\AppData\Local\Temp\97b187e01326280b838be47599ab5eae9890bffeb9827f2df247554de5c67a6eN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5132
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UseWatch.bat" "1⤵PID:3608
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d8 0x4f01⤵PID:5956
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RemoveAssert.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD5fb4901c07d788d807a09c870d784c59d
SHA1ae5ecd800710d968e1fb169f417fab68fd34c3d2
SHA256e5c753574ddb4a505f43d714e577e5fa9db5f064bb8af85c06b25d37f4203ebf
SHA5126ca5a06f45f798805ea5845c8fe99102ab6f7516be861511462aec6a22effc635f4de5b4827295c90826d53308c467ec377e72dd33c51e69a1abe06dcf31e05c
-
Filesize
65KB
MD501652a2dbe84b8a859a9b71098dcf14c
SHA19c9b5dca8f8659582d86e47f1bd9a3b35f2a9c38
SHA25697bf0ff4d5aa12f0263d62426889aeb3c7bbf4a744a689d607057ab0056742c9
SHA51248276578a5415feb2f3c538a8f44d311d5cc119c6cba583abd541c9c24eabf7759bcb3eaacb189f6be1122accdfd4dc91c8e3bc3d54f98f31f2fe4bfc53b776c