Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 08:23 UTC
Behavioral task
behavioral1
Sample
a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe
Resource
win7-20240903-en
General
-
Target
a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe
-
Size
72KB
-
MD5
62be19596e8019d7a7a20441971b5051
-
SHA1
1cd40999f303ccf257f961356310a9094800c9f8
-
SHA256
a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7
-
SHA512
20d3a13bf518d35789473f5185b44feb280af3116b8f82cee05674df8a1ac5715d9c7ee2b40f8271196d81a112dd32d8e570fa40b3c9e95c3e1c11c9cd44405b
-
SSDEEP
1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211N:7dseIOMEZEyFjEOFqTiQm5l/5211N
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 2864 omsecor.exe 2456 omsecor.exe 2700 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 2864 omsecor.exe 2864 omsecor.exe 2456 omsecor.exe 2456 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2864 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 28 PID 2792 wrote to memory of 2864 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 28 PID 2792 wrote to memory of 2864 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 28 PID 2792 wrote to memory of 2864 2792 a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe 28 PID 2864 wrote to memory of 2456 2864 omsecor.exe 32 PID 2864 wrote to memory of 2456 2864 omsecor.exe 32 PID 2864 wrote to memory of 2456 2864 omsecor.exe 32 PID 2864 wrote to memory of 2456 2864 omsecor.exe 32 PID 2456 wrote to memory of 2700 2456 omsecor.exe 33 PID 2456 wrote to memory of 2700 2456 omsecor.exe 33 PID 2456 wrote to memory of 2700 2456 omsecor.exe 33 PID 2456 wrote to memory of 2700 2456 omsecor.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe"C:\Users\Admin\AppData\Local\Temp\a81b05651fb9add88cfc756f95895a2878a172439267b21db279aaf840b9d5c7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700
-
-
-
Network
-
Remote address:8.8.8.8:53Requestlousta.netIN AResponselousta.netIN A193.166.255.171
-
Remote address:8.8.8.8:53Requestmkkuei4kdsz.comIN AResponsemkkuei4kdsz.comIN A3.33.243.145mkkuei4kdsz.comIN A15.197.204.56
-
Remote address:3.33.243.145:80RequestGET /870/870.html HTTP/1.1
From: 133819214042926000
Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>312.^lby>.f54f656d6c202e/d3362281469.bb_6
Host: mkkuei4kdsz.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
date: Tue, 21 Jan 2025 08:24:27 GMT
content-length: 114
-
Remote address:8.8.8.8:53Requestow5dirasuek.comIN AResponseow5dirasuek.comIN A52.34.198.229
-
Remote address:52.34.198.229:80RequestGET /623/405.html HTTP/1.1
From: 133819214042926000
Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>312.^lby>.f54f656d6c202e/d3362281469.bb_6
Host: ow5dirasuek.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 21 Jan 2025 08:24:38 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=c2ffb5d06bb2ba7b2b87f16fb4bf9cb1|181.215.176.83|1737447878|1737447878|0|1|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
-
Remote address:3.33.243.145:80RequestGET /997/524.html HTTP/1.1
From: 133819214042926000
Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>312.^lby>.f54f656d6c202e/d3362281469.bb_6
Host: mkkuei4kdsz.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
date: Tue, 21 Jan 2025 08:25:50 GMT
content-length: 114
-
152 B 3
-
152 B 3
-
473 B 644 B 6 5
HTTP Request
GET http://mkkuei4kdsz.com/870/870.htmlHTTP Response
200 -
421 B 623 B 5 5
HTTP Request
GET http://ow5dirasuek.com/623/405.htmlHTTP Response
200 -
152 B 3
-
152 B 3
-
381 B 604 B 4 4
HTTP Request
GET http://mkkuei4kdsz.com/997/524.htmlHTTP Response
200
-
56 B 72 B 1 1
DNS Request
lousta.net
DNS Response
193.166.255.171
-
61 B 93 B 1 1
DNS Request
mkkuei4kdsz.com
DNS Response
3.33.243.14515.197.204.56
-
61 B 77 B 1 1
DNS Request
ow5dirasuek.com
DNS Response
52.34.198.229
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5aeea7c7245792599f748893709bdab47
SHA12c3ea2f557a2b7d1d8ae0a879ce618c4457ec0a7
SHA256682b4e99ce94a8c75d405d60e0167cb07a2f3b66e32a2a73c5f54a706fe72f65
SHA5129bc195ba12e7791800bc4079e14fdb22ec4e4ce7d80cfd9df0e1685e0d346ef08db59e431e846f3b7d4c546132bc2ddfe09269818b9af2822bd2335332ac8d66
-
Filesize
72KB
MD5c48f689e91bf1254689a35499743c72f
SHA126082398b34d57cdfe92fb9baad09b81a8f3bfaf
SHA256d87ee71f3788d8473f29287f0ef1c666fd6d4b0f568f8c2fb8cb6f2706acdf17
SHA5126a6d506bf95940af83faa01792f0a44d85a5f22b6ac033dfc6faf603ec1b682866ebed1cca4d810f5ec6a4bbcdb3c81bf6677cb463e50b9b1148b762d268629d
-
Filesize
72KB
MD561a0e3d6ab92b0f156c33c459ea9a945
SHA154fbd8feece208e8a36b94c7ab6d7395c57d5810
SHA256e133854244f1cd01ecc16bb795ca12b766a1914071c60bd9fde2b450b7ab357e
SHA51290af1d7f53b53fb6071a70d822239136d7a1b45def1a4c4eb84468f65f0daf0fbbe5ba3e8f75a6687e9e1d920f20ec1cd4719646d1237c6ee47d68c7e6e813c9