Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 06:13

General

  • Target

    38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe

  • Size

    96KB

  • MD5

    974c6c7e364717a92b1f54f5d654fe20

  • SHA1

    f474b144d14d24f20aa28f4037a4d3c9d9cc806d

  • SHA256

    38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9

  • SHA512

    6496d425bc88f0a53ac81b479e05c5bf8738e898c9cf32109cb0f12e806368b87f5c2bd18c8709bc3aacf8b72c43ae6aee90e6e2047bfafe3616df1581c32143

  • SSDEEP

    1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:NGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
    "C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
      C:\Users\Admin\AppData\Local\Temp\38fbb0179143b5f06e66b5987febaf1354093db23d3a1482a095842f4e81e0b9N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1372
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2856
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1040
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1916
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1392
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 256
                  8⤵
                  • Program crash
                  PID:2524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 292
              6⤵
              • Program crash
              PID:4456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 288
          4⤵
          • Program crash
          PID:4876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 288
      2⤵
      • Program crash
      PID:2204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4616 -ip 4616
    1⤵
      PID:4856
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1372 -ip 1372
      1⤵
        PID:4144
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2856 -ip 2856
        1⤵
          PID:5016
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1916 -ip 1916
          1⤵
            PID:4956

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            749f06594ca626d54c95d1a43ff0495d

            SHA1

            97984f031a872ec17d48f4f7b418054a5e73a755

            SHA256

            b83f4aa614e39018bdd344319a8cafeb0642487eb575bf2621c1c57a2bb49a95

            SHA512

            ae3a0e42c935c3029514caaab17cef24dcaa7adc3b9cd8c85e37b3928dfb3eb87d28b8d68ea142324e2b80cda766e56fdb178a9ba2b08ddfe3efde6eb32372fa

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            b5fb6c75d8e72cc1c36531d5f4420aae

            SHA1

            d923ab3f2fccd434e642024da3d29cef3cf77c39

            SHA256

            c95783b32a67731daa53bf7233e53712f9c86bfc0188f59e8e78d72a9c8477a6

            SHA512

            27042afc8668f82e41702a2b9aae57038aa9fb073c82f2988be4aab6e41657523d5fbae42db0319ecc4593104494bb3671aca2aacef8f1a47737c8d022f68111

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            96KB

            MD5

            4c4e5d4ad8b80aa5e4f9df9a9bcdf902

            SHA1

            068d96ef34f5a511f20e5c0572b921c7ecf72692

            SHA256

            3de774bd5121dbcdb61b018fa92e427238999b0c5ee59661d4c9af5b79ef5bdf

            SHA512

            eda54d977aadb29787bad0bb22e2c8bd7f57164d7b654ce397c467a0496a01ce4cbb5c6434a19c66c90cce53b85aee84059994fa8bbbfe28db5b6a992f22dbe3

          • memory/1040-35-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1040-38-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1040-36-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1188-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1188-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1188-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1188-5-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1372-11-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/1372-16-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/1392-51-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1392-47-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1392-48-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1916-43-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/2856-32-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3504-25-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-15-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-28-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-18-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-24-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3504-21-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4616-17-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4616-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB