Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 13:19

General

  • Target

    6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe

  • Size

    96KB

  • MD5

    e108e8f374797fefd9917f5563343b00

  • SHA1

    306763d0a77657d638e093d4ac809187f709cf27

  • SHA256

    6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1

  • SHA512

    1cca39848bd09ef84a534d98a8a725272ae23ad054978b4d96c63cc12d30339119b97c9b8a79709fe00ff6797adc2aea9e8fd878147002f93abe51fede03aaad

  • SSDEEP

    1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:BGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe
    "C:\Users\Admin\AppData\Local\Temp\6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe
      C:\Users\Admin\AppData\Local\Temp\6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1300
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3972
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4420
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3672
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 256
                  8⤵
                  • Program crash
                  PID:2320
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 292
              6⤵
              • Program crash
              PID:2948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 288
          4⤵
          • Program crash
          PID:3008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 300
      2⤵
      • Program crash
      PID:3084
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2220 -ip 2220
    1⤵
      PID:4620
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3244 -ip 3244
      1⤵
        PID:4496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1300 -ip 1300
        1⤵
          PID:116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4420 -ip 4420
          1⤵
            PID:1268

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            d2188cf7527ee0bdf3d1f037e88d9e74

            SHA1

            6dcd97d3ff0b44fb5dfb9801960a20f58ad6aee9

            SHA256

            d3e18d63f91591946a7c43c3d14706bf1260d85a603a2b60bbbf78dbd47413fa

            SHA512

            e18f2e985ec7b79cf57f3090cb30c4608c1f9ca467e41cf6c8bec90ce4d242bb27ef5f80dbe987bef36f89ebcde181e87698bc56d6936cd9282daa28db251434

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            bc3bff3f86a8d42adcd14dc7053b4154

            SHA1

            364aefbc6a147d78e4692d5564fff0e9310b0b60

            SHA256

            f9d38c3d3bf1b245cb1baacc4c5c20b7180d0c3776152d9b19e063267e3fcd76

            SHA512

            1ab18189be17bbf066925ef6dbde43693cec458022715a62ea4bac967dfb69856478ee2c3449d2cf1754058986fe288414b6d76fad81802ecb1b200af45a0b86

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            96KB

            MD5

            9c1e7b2802b4f05919dbfbff31fac6e1

            SHA1

            1abd629f9eebd800b3514f89fb28f4f4664ec93b

            SHA256

            1ea616513abf14341fd3fbdd151034ba93d5b0be737b86f4ce7db76b20a7a605

            SHA512

            8e1be915d4c8da6087c865f5058f456b613718a803babe5dc80cf68e73474276854115bd665a3c1344e41461e98d32b19386a5a40d91525dc2cfe8c316093883

          • memory/1168-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1168-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1168-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1168-5-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1300-53-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/1300-34-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2220-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2220-19-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3244-8-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3244-17-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3672-55-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3672-51-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3672-50-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3972-38-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3972-41-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3972-39-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-33-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-27-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-26-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-23-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-20-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4408-15-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4420-46-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4420-54-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB