Analysis

  • max time kernel
    114s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 17:57

General

  • Target

    dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469N.exe

  • Size

    96KB

  • MD5

    82bbb006b062bb4abcfa4f23d8657960

  • SHA1

    4fed425c1d5f832e8996c3c877ba2933a5d904c5

  • SHA256

    dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469

  • SHA512

    55710cbe8106aa67755e57323d8731c0dea40717a54ce66f0aee9ece962e21bae86117d0eb5d9c430c5b3ac9b39f0a7cca620f59f70beb2facc2331e1d32e1d6

  • SSDEEP

    1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:SGs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469N.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469N.exe
      C:\Users\Admin\AppData\Local\Temp\dbe28c1e7ed67ebaacd6e85f0189356720badc2839c932b0320ff9b6f94bb469N.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2916
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:768
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2212
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    1039e1b2a4ffa2e97636737e46a14076

    SHA1

    3b0b1773ef4282ae50abfc3e7f046374ef1f9a3f

    SHA256

    b9e3d2436f28ff7cd506a00e6a04fd78b9cab7a0792087606e736fb09afe2f4c

    SHA512

    054894b232689f8e0ae3aeea12e4290b9014e503c74a4c8f192bff1f8a3101af42ffd2c86af6bbdee8f2b46937e83f6bfec5c714936e238eb29197629d4471b2

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    3edac1da41bc9aeb4052369a2341c5fc

    SHA1

    5bc0065137eb37b6c35c919f22ae3496ddf99b85

    SHA256

    059e5d91effe675a6e2d5b8943397217b55a6fe810b49887f567b6e80c0db780

    SHA512

    f95bbbfaa390df819abd3a3a470c187ab4e43e3a216914d0a0907385075565994b8bf4ae5b09f84f630e397c4334fea9cf50c86ea4cfcf05433d63cf35ecea72

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    96KB

    MD5

    cb2471ee0ff48c4706c36aacad8f9de9

    SHA1

    537547163407850ebc9bb818d77b0182701783ac

    SHA256

    82b0a15488b6f4283ae83ae3d8c38abfd4a203a1b295cf37924fe556fe00cf6a

    SHA512

    5427f551498e178b3c65ef72394e854ca1a3c1c1fe09eeb5ef732f54ecc977b539b5218eb841450c914f5347417d68aedbaa501feef50334381ba30ca2d7c7b6

  • memory/1980-7-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1980-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2112-89-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2212-87-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2212-79-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2404-21-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2404-31-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2800-52-0x00000000002D0000-0x00000000002F3000-memory.dmp

    Filesize

    140KB

  • memory/2800-53-0x00000000002D0000-0x00000000002F3000-memory.dmp

    Filesize

    140KB

  • memory/2800-40-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-43-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-34-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-37-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-56-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2916-57-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2916-66-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/3032-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3032-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3032-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3032-5-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3032-1-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB