Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2025, 20:52

General

  • Target

    17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe

  • Size

    61KB

  • MD5

    a74cb5983f2c35758dbfb8918f1c1de3

  • SHA1

    8d44cd64264c145feeb9ce87f9a77e4c3edca65e

  • SHA256

    17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f

  • SHA512

    4cc0792d2bb0ba057a0812262adabdc076a9bca756b25ee8b8a3fdda9d2e4e6b888c3202dac93b1397d75a61dd674125014a59a8e853c942c6bd308e90530bf3

  • SSDEEP

    1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZll/5:ydseIOMEZEyFjEOFqTiQmPl/5

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
    "C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    61KB

    MD5

    41422c255d5f2705e193a5b309e1fe5d

    SHA1

    0eb19a01a8dc99420dd77b3a39f0672c729391a9

    SHA256

    ef23364585d9242c5fdbda6268ba296d2a68106ed4085f08512edb6d5f913ed7

    SHA512

    b697b2f63eb83a9432d0b433a5dc8c64db4e878830f43b37d3609521630c83037bfb92cc06a5eef28e16c1c0ebe765b82f8577a985f1525f1df09786a93be888

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    61KB

    MD5

    6cf2457d1ed3508b97412f694ef399f7

    SHA1

    2bef013201a89766480d54e714c1bde6a61a8cca

    SHA256

    c2a8559aaee120eb7b3002860244c1c4634cbb9ed6a40d365df35dfc1dcafa49

    SHA512

    5d90214573b34bfc914aba2c34515fcd03a585fc02f58e82c4214906e3f2266b15a7fcacc2f9cbca5f97f3842df883b2064c53064b74ffc65ae6613dd8079dbe

  • C:\Windows\SysWOW64\omsecor.exe

    Filesize

    61KB

    MD5

    31adaaffb0f056219ce67ecaf78fd410

    SHA1

    13c17acc7f147ecabedf7ca2cc8af3f37191a3a9

    SHA256

    863df7612e07bcf56b6c6521bbe1557a88e97c8028946b5bf90250672ee47250

    SHA512

    baa8eb4b233937a46aa57be3a02b7e6b50eb472af06349728ca74a341eb7e06d2d86724ba107c0056225658f3341f32bc675bad706d004b77c64b3d9e67cd6b5