Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 20:52
Behavioral task
behavioral1
Sample
17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
Resource
win7-20240903-en
General
-
Target
17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe
-
Size
61KB
-
MD5
a74cb5983f2c35758dbfb8918f1c1de3
-
SHA1
8d44cd64264c145feeb9ce87f9a77e4c3edca65e
-
SHA256
17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f
-
SHA512
4cc0792d2bb0ba057a0812262adabdc076a9bca756b25ee8b8a3fdda9d2e4e6b888c3202dac93b1397d75a61dd674125014a59a8e853c942c6bd308e90530bf3
-
SSDEEP
1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZll/5:ydseIOMEZEyFjEOFqTiQmPl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 4208 omsecor.exe 1520 omsecor.exe 2272 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1724 wrote to memory of 4208 1724 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe 82 PID 1724 wrote to memory of 4208 1724 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe 82 PID 1724 wrote to memory of 4208 1724 17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe 82 PID 4208 wrote to memory of 1520 4208 omsecor.exe 92 PID 4208 wrote to memory of 1520 4208 omsecor.exe 92 PID 4208 wrote to memory of 1520 4208 omsecor.exe 92 PID 1520 wrote to memory of 2272 1520 omsecor.exe 93 PID 1520 wrote to memory of 2272 1520 omsecor.exe 93 PID 1520 wrote to memory of 2272 1520 omsecor.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe"C:\Users\Admin\AppData\Local\Temp\17360f7e478974170e678c862f2055162d89bb7b8e5be36f4a08873ec92e0c9f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD541422c255d5f2705e193a5b309e1fe5d
SHA10eb19a01a8dc99420dd77b3a39f0672c729391a9
SHA256ef23364585d9242c5fdbda6268ba296d2a68106ed4085f08512edb6d5f913ed7
SHA512b697b2f63eb83a9432d0b433a5dc8c64db4e878830f43b37d3609521630c83037bfb92cc06a5eef28e16c1c0ebe765b82f8577a985f1525f1df09786a93be888
-
Filesize
61KB
MD56cf2457d1ed3508b97412f694ef399f7
SHA12bef013201a89766480d54e714c1bde6a61a8cca
SHA256c2a8559aaee120eb7b3002860244c1c4634cbb9ed6a40d365df35dfc1dcafa49
SHA5125d90214573b34bfc914aba2c34515fcd03a585fc02f58e82c4214906e3f2266b15a7fcacc2f9cbca5f97f3842df883b2064c53064b74ffc65ae6613dd8079dbe
-
Filesize
61KB
MD531adaaffb0f056219ce67ecaf78fd410
SHA113c17acc7f147ecabedf7ca2cc8af3f37191a3a9
SHA256863df7612e07bcf56b6c6521bbe1557a88e97c8028946b5bf90250672ee47250
SHA512baa8eb4b233937a46aa57be3a02b7e6b50eb472af06349728ca74a341eb7e06d2d86724ba107c0056225658f3341f32bc675bad706d004b77c64b3d9e67cd6b5