Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 15:37

General

  • Target

    065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe

  • Size

    76KB

  • MD5

    81fcbbf335f57c98713f9ed7cbde61c0

  • SHA1

    fd441e63eba1e52c49fe0a4c746cb68177af9979

  • SHA256

    065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76b

  • SHA512

    c9476c644af262c4c9339b82d913922e867e91994512523624cf7675db5be265ce495c7b4493e5d0ae4ce877587371acb6d2197481fe92346f65c1b197f38760

  • SSDEEP

    1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11f:kdseIOMEZEyFjEOFqaiQm5l/5w11f

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
    "C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    76KB

    MD5

    ae1487c3d2b7d2a7485d9bb6261708a5

    SHA1

    26e7473bb57b5f67bef435eb159bc8af269e3694

    SHA256

    159324e1ae77e4051db840c317bd6ed04751082bb66d372f077563ec47919049

    SHA512

    5d17ef745ad46bdd00803cda54690124936ab64e29480a2cf9961ac536d5a3bdb3d654c3012d91fde355e32bbae1a2d4582c3cc9a53805cf93a4b67d4c9c393e

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    76KB

    MD5

    f64ea2fa9bb76fd9e3ed2ff36e05b04a

    SHA1

    3be7d2a55f38d6775c907fcea19caf6d3582a640

    SHA256

    acf5f3357654db076d1dd24e3bef84d9f7b4c16a07f0a742ff16c35e6bda865e

    SHA512

    43d16429e8972fec08404737316ffee1e792120d586d5e6362986d9f10b7192d1763c1e13b6affabd66aac73cd8a99b0d13f9969a19dc5f15fe96eb39dacd6ce

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    76KB

    MD5

    cf966f5356fb930c5fc84a59bb8101b9

    SHA1

    a7d40db4f8bc2e8f6a07e763f1bf177be3e3d6c7

    SHA256

    44b7d7b927dee31cf6f9859beeff124755661be5d4c3ad6008aba6fd37a60742

    SHA512

    e64cd9cff8f82e9e7b5f1b3a5261a74d6100f6bc633a6656c200b23ff26a1ddfeffc3cb74444d716a52973077e35eb46e1c33c0ad4adf3129c1866c42ff358c8

  • memory/1932-35-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2624-27-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2756-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2756-8-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2772-10-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2772-12-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2772-17-0x00000000005A0000-0x00000000005CA000-memory.dmp

    Filesize

    168KB

  • memory/2772-24-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB