Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 14:19

General

  • Target

    7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38N.exe

  • Size

    96KB

  • MD5

    d1c25d28aa9af072868f45ef116b3740

  • SHA1

    ea8f590868b6dfdadae4ddf8e37b0f3973b1ecd6

  • SHA256

    7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38

  • SHA512

    2ca62e04345a1ae85b50db9875493e2b0750dae5514cb2469f9160b052c21800c60e457342a6e330ffd41d97e2fde3f6732bda90a21c1f362a0164f4241e7358

  • SSDEEP

    1536:rnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:rGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38N.exe
    "C:\Users\Admin\AppData\Local\Temp\7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Users\Admin\AppData\Local\Temp\7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38N.exe
      C:\Users\Admin\AppData\Local\Temp\7ec7417b9746b94dffa98075f7e15a52ccf18763e5d4784555a2f8b11d1e8a38N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4800
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4400
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 268
                  8⤵
                  • Program crash
                  PID:4876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 292
              6⤵
              • Program crash
              PID:2100
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 300
          4⤵
          • Program crash
          PID:3672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 288
      2⤵
      • Program crash
      PID:1060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3232 -ip 3232
    1⤵
      PID:1736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3600 -ip 3600
      1⤵
        PID:4200
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4360 -ip 4360
        1⤵
          PID:3736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4400 -ip 4400
          1⤵
            PID:1148

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            88a0c5d9d1e4c67496a74074b81b45e0

            SHA1

            183c22825d260ae6d303eb6887087bbd3854c462

            SHA256

            24074e2973dc2761593714c3332418948ff9ea5d20bfb9b704c8dd4b60c35eae

            SHA512

            6896ce6d0183d032468613dee046bc9c62ad9275c4be7aac369f58a031b2dea23fdfb9431bf9a41545464b081c2e26ce970aa8b90732535b7fe3b1ddc6f67e15

          • C:\Users\Admin\AppData\Roaming\omsecor.exe

            Filesize

            96KB

            MD5

            194cdea28d4d0786e88cd47cb76216c0

            SHA1

            e95511031fadde5d9294e9efd75c70f2bc304ece

            SHA256

            2fdb24c71ea6cb9c44022d9f33b2e548517c6abb42240d6adf6063690065854e

            SHA512

            de3dfa34e49899892be2f8fe62d158fcdcc62822d4b84a202c75aeddfdee6e35c406f1a9925a70616c76077b6aaa5b91e6076230b4d762d0edf2a3a660922304

          • C:\Windows\SysWOW64\omsecor.exe

            Filesize

            96KB

            MD5

            b109a32fb14a06150edfaff435d9d4b1

            SHA1

            ed533e58c011c7c6b207a3a7b6243b8c81b59250

            SHA256

            46376e3dfaffc98541a164c936e027d46540b52ef4eb153ae4c88b8f9bfae0d1

            SHA512

            08d675d37dda6a978d6582734ae9ed75c2ddeea9dcd9885c1a7e015ef495092ee13b696a2723204d351334f739e3262f5f2971557cdcf33bb3783eb6282758e8

          • memory/1508-37-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1508-36-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1508-39-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3232-17-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3232-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3600-18-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3600-7-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/3744-1-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3744-2-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3744-11-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3744-3-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4360-31-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4360-51-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4400-44-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4684-49-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4684-48-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4684-53-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-30-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-26-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-14-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-25-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-22-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-19-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4800-15-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB