Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 22:34 UTC

General

  • Target

    2bcbb7ad65019c8d00962baf5de9aa340c0ff69b0e243ab0a9dbebf16e1d6342.exe

  • Size

    72KB

  • MD5

    63c3eac87a43e1045b78d95d7ec1d2ba

  • SHA1

    a7b9d2f39670f3a035484c521487d15d765de400

  • SHA256

    2bcbb7ad65019c8d00962baf5de9aa340c0ff69b0e243ab0a9dbebf16e1d6342

  • SHA512

    a5b435c60876ee7d87d1efe719b3d3dab4befa82ab35c899a5730a369ac97ddb7a0709502ce7279f1c2d19eb87b6bb1634631869a5ae8a525d61e78e05f34787

  • SSDEEP

    1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211H:bdseIOMEZEyFjEOFqTiQm5l/5211H

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bcbb7ad65019c8d00962baf5de9aa340c0ff69b0e243ab0a9dbebf16e1d6342.exe
    "C:\Users\Admin\AppData\Local\Temp\2bcbb7ad65019c8d00962baf5de9aa340c0ff69b0e243ab0a9dbebf16e1d6342.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:292

Network

  • flag-us
    DNS
    lousta.net
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    lousta.net
    IN A
    Response
    lousta.net
    IN A
    193.166.255.171
  • flag-us
    DNS
    mkkuei4kdsz.com
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    mkkuei4kdsz.com
    IN A
    Response
    mkkuei4kdsz.com
    IN A
    15.197.204.56
    mkkuei4kdsz.com
    IN A
    3.33.243.145
  • flag-us
    GET
    http://mkkuei4kdsz.com/393/138.html
    omsecor.exe
    Remote address:
    15.197.204.56:80
    Request
    GET /393/138.html HTTP/1.1
    From: 133817996902902000
    Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6451aoe|A07f4<h084a;i34je;<2<j3if2h<0d69:
    Host: mkkuei4kdsz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    content-type: text/html
    date: Sun, 19 Jan 2025 22:35:54 GMT
    content-length: 114
  • flag-us
    DNS
    ow5dirasuek.com
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    ow5dirasuek.com
    IN A
    Response
    ow5dirasuek.com
    IN A
    52.34.198.229
  • flag-us
    GET
    http://ow5dirasuek.com/349/715.html
    omsecor.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /349/715.html HTTP/1.1
    From: 133817996902902000
    Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6451aoe|A07f4<h084a;i34je;<2<j3if2h<0d69:
    Host: ow5dirasuek.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 19 Jan 2025 22:36:04 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=55b0d037ab8410b200445bd1c662eae6|181.215.176.83|1737326164|1737326164|0|1|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://mkkuei4kdsz.com/779/949.html
    omsecor.exe
    Remote address:
    15.197.204.56:80
    Request
    GET /779/949.html HTTP/1.1
    From: 133817996902902000
    Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6451aoe|A07f4<h084a;i34je;<2<j3if2h<0d69:
    Host: mkkuei4kdsz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    content-type: text/html
    date: Sun, 19 Jan 2025 22:37:17 GMT
    content-length: 114
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    152 B
    3
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    152 B
    3
  • 15.197.204.56:80
    http://mkkuei4kdsz.com/393/138.html
    http
    omsecor.exe
    519 B
    644 B
    7
    5

    HTTP Request

    GET http://mkkuei4kdsz.com/393/138.html

    HTTP Response

    200
  • 52.34.198.229:80
    http://ow5dirasuek.com/349/715.html
    http
    omsecor.exe
    421 B
    623 B
    5
    5

    HTTP Request

    GET http://ow5dirasuek.com/349/715.html

    HTTP Response

    200
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    152 B
    3
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    152 B
    3
  • 15.197.204.56:80
    http://mkkuei4kdsz.com/779/949.html
    http
    omsecor.exe
    381 B
    604 B
    4
    4

    HTTP Request

    GET http://mkkuei4kdsz.com/779/949.html

    HTTP Response

    200
  • 8.8.8.8:53
    lousta.net
    dns
    omsecor.exe
    56 B
    72 B
    1
    1

    DNS Request

    lousta.net

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    mkkuei4kdsz.com
    dns
    omsecor.exe
    61 B
    93 B
    1
    1

    DNS Request

    mkkuei4kdsz.com

    DNS Response

    15.197.204.56
    3.33.243.145

  • 8.8.8.8:53
    ow5dirasuek.com
    dns
    omsecor.exe
    61 B
    77 B
    1
    1

    DNS Request

    ow5dirasuek.com

    DNS Response

    52.34.198.229

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    72KB

    MD5

    c86e4bd678490701b4cf87749fec8249

    SHA1

    895fc35ce5a384882111a376a630b227876ea605

    SHA256

    d3cf8a0a47d7e3d1cdd370acb551753bb4b69b389242a1673ded2170dde8bb21

    SHA512

    356db7fc3b604dcefd26cba1fe194a06895c34b95af3ea9356c978848ca8d04377542489dcea51ae3f35fe53efa587bf125b776cc915e646aeccc935302a7a72

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    72KB

    MD5

    7aa684bca2f474d1490c016504595726

    SHA1

    8f7390d9883ea1793c3ea05ef3637bb5de55c868

    SHA256

    57b4bf966900d8f0f3a71c070da4ae4eb65588d2c6757b6e74ab5c91febb0acd

    SHA512

    b3035ecaa111e1d1fa4111f3f43f4b30e0d19b184236f6a321ff654f61e561d939911e90e436c043458e208d76ece71cec608081010412758bfeaa114802751a

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    72KB

    MD5

    ce39eb2f7327acbcbb7815b9e0d79206

    SHA1

    9a6725664e2e4f6a794de10347714b18b54f376b

    SHA256

    cc8ec9112c487084125047cb0e091dac09bb6536e8e53f4ea367a0af52a70b8d

    SHA512

    8516412261d9385ed4b6e25ada87d4266a3b98312703a31786899131a833a34fc54966750edbd0dd935920ecac23e9a98e2edd78da2249604a58ec3a98cf59de

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.