Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 16:00

General

  • Target

    5f3d5f3ac404b493c79aaf8f48f259c07624c4890009c38943649521927c8ce5N.exe

  • Size

    76KB

  • MD5

    a0272e6696253c44389e1c479d1414d0

  • SHA1

    776216cb2cb426a382eb1f60fd7327a586440260

  • SHA256

    5f3d5f3ac404b493c79aaf8f48f259c07624c4890009c38943649521927c8ce5

  • SHA512

    fd20b0d38d67be144dfa5cc618ed8f3b2c6a7c7fce486d3079fd4ff70ba7a45e01e60488a0b868f52c38b3e2ab5954906329b0e2c7cd7e673924588356bf9ecf

  • SSDEEP

    1536:vd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:HdseIOMEZEyFjEOFqaiQm5l/5w11

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f3d5f3ac404b493c79aaf8f48f259c07624c4890009c38943649521927c8ce5N.exe
    "C:\Users\Admin\AppData\Local\Temp\5f3d5f3ac404b493c79aaf8f48f259c07624c4890009c38943649521927c8ce5N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:1112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    76KB

    MD5

    c09ced903103d15271e9083abe6fd953

    SHA1

    684e5631117f0ba6de4e46b42138c73ec0b7f7df

    SHA256

    b6fa58efe98fde3963c70168b6f0d6a0ad32aa5b5cbfc9a17a0578468c8c1fe1

    SHA512

    94e0875453c1f781edaddb4cee0b7c943d5a5ab96a33ea31b64c9f5fb9dbd202eb11cc5019520534dba6aedcb2b19caf504b9132ca18a8d6b5595216533d54ba

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    76KB

    MD5

    f5719fa617c9a943c64df1ead1433491

    SHA1

    18d80f9710a6c2308da20d0b9fc44509eac1037c

    SHA256

    dfbede0f5427dd4d979b0139523a95e23e17a8ce9c693d7b0f580bb83cd913be

    SHA512

    f2e5b8db93d04dc56df2b85a02b821d500d183340c0f040f52ce8d1bc4547358f47b1506bf536028b0cc025d77d16bbf2cdfbdfdeb9ceb43609f52141d518863

  • memory/1112-25-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2100-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2680-9-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2680-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2680-16-0x00000000002A0000-0x00000000002CA000-memory.dmp

    Filesize

    168KB

  • memory/2680-23-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB