Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 06:13

General

  • Target

    38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe

  • Size

    96KB

  • MD5

    974c6c7e364717a92b1f54f5d654fe20

  • SHA1

    f474b144d14d24f20aa28f4037a4d3c9d9cc806d

  • SHA256

    38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9

  • SHA512

    6496d425bc88f0a53ac81b479e05c5bf8738e898c9cf32109cb0f12e806368b87f5c2bd18c8709bc3aacf8b72c43ae6aee90e6e2047bfafe3616df1581c32143

  • SSDEEP

    1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:NGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
    "C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
      C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:292
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:912
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1412
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1908
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    b5fb6c75d8e72cc1c36531d5f4420aae

    SHA1

    d923ab3f2fccd434e642024da3d29cef3cf77c39

    SHA256

    c95783b32a67731daa53bf7233e53712f9c86bfc0188f59e8e78d72a9c8477a6

    SHA512

    27042afc8668f82e41702a2b9aae57038aa9fb073c82f2988be4aab6e41657523d5fbae42db0319ecc4593104494bb3671aca2aacef8f1a47737c8d022f68111

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    96KB

    MD5

    5425a39d12d41e0b8843b479fb9b8526

    SHA1

    8dc2a1504770d72ff1bde1d0c123690727fdc296

    SHA256

    d20c194ecd456987ab10e5106c5c54670b03fcd0ea65bfe9a99ad35d842027f2

    SHA512

    7315dcc53ae97419052d07ab8abb135ccbf2f46823a87336324bcae04136573f564b788aaed52a7170f495da1cf43949ce5efebb724e01b5050f7cd6e3ebe534

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    96KB

    MD5

    52d5aebf6d72b4e7ec838ddf69dc4650

    SHA1

    4c12683c989f26c96a622a8ade915408eb12fd4a

    SHA256

    b9bd47f37b0501997e7562182e36343b5f2a5c2790da8bd33be81bfae65eb15a

    SHA512

    43f1c2b1109e0ab460d3f22dde735e95a0810b40d1e8a4111ba934d80fab20fd2b4cec88ccb4ebe62785e752e78dcbe9404ba3b93f00f12fc6863eb8752a05a6

  • memory/292-38-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/292-35-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/292-55-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/292-48-0x0000000000290000-0x00000000002B3000-memory.dmp

    Filesize

    140KB

  • memory/292-44-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/292-41-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/912-66-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/912-57-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1200-90-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1412-72-0x0000000000230000-0x0000000000253000-memory.dmp

    Filesize

    140KB

  • memory/1908-88-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1908-80-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1976-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1976-5-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1976-1-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1976-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1976-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2296-9-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2296-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2440-21-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2440-26-0x00000000003C0000-0x00000000003E3000-memory.dmp

    Filesize

    140KB

  • memory/2440-32-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB