Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2025, 19:42

General

  • Target

    0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833.exe

  • Size

    96KB

  • MD5

    702d7d818e2b3e5661a7c61433a20118

  • SHA1

    1ffe06c9db1e8178806bfe02e971b17b261f7abc

  • SHA256

    0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833

  • SHA512

    7fa4b86a390a0a658f5f95edce7d731375cb36bdb9dde4bb4230441e83c51260c59c84b6c6291de8a0e6026c5f65c356244205943ef588cb2067550b79da8124

  • SSDEEP

    1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:HGs8cd8eXlYairZYqMddH13r

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833.exe
    "C:\Users\Admin\AppData\Local\Temp\0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833.exe
      C:\Users\Admin\AppData\Local\Temp\0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3936
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1572
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1820
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3736
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1968
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 268
                  8⤵
                  • Program crash
                  PID:1480
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 292
              6⤵
              • Program crash
              PID:4632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 296
          4⤵
          • Program crash
          PID:2180
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 288
      2⤵
      • Program crash
      PID:1760
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2312 -ip 2312
    1⤵
      PID:5088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3936 -ip 3936
      1⤵
        PID:3868
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1572 -ip 1572
        1⤵
          PID:4032
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3736 -ip 3736
          1⤵
            PID:1288

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            bed19c142bd55c8d368e128c2418f3ee

            SHA1

            2eca45e55eb4eb4dd87eb2c89e03e2fbde7e0620

            SHA256

            450118456a0597f81cd0070d5a773e628f0c1aa43d100b6b2b13023127aa72bd

            SHA512

            2f744b7d8fad229f6a8a31bcb21c871deb5a4b066e6da4981a08a94f0eb426f781eeb35cdba0dd768a5061fbe50f509b38d9b585086f6aec53c8b2503d23c66c

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            ae753e5386a5755c298250f922a62d8a

            SHA1

            75aee149c21d4df745f170fa8d67522a8b97ca23

            SHA256

            aca3f9808ede1d037dbbe66d98a556c2844821b2405d92ef290f033fcf77d22d

            SHA512

            a8b01c55bd1d5e2703544141bced2cd430234e082719b9428628b2cc4e8e4053cc0ebef7244d9d61f1a1797ded3c53aaa8760d1603ef933710c2930dcde9824b

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            96KB

            MD5

            c2efcce4bf0ad4e3828e15ff9635a99e

            SHA1

            a7409a65c679b235ad4c7ae1ac0595fe1af10ea6

            SHA256

            910ce5e0594624972144188727b553328af83c24786517c2f67e344f4c307ea3

            SHA512

            60170e7224ab1c8f597264d804fcf2982e817d42f529e707d997ddd56737b6fd8d329e41411f237eeb44983056d763bfcf790d2f9c90418ce76cff704be7f41c

          • memory/1528-26-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-30-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-15-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-27-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-20-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1528-23-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1572-52-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/1572-33-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/1820-37-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1820-38-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1820-40-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1968-50-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1968-49-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1968-54-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1968-57-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/2312-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2312-18-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3044-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3044-5-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3044-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3044-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3736-45-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3936-11-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB