Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 15:37
Behavioral task
behavioral1
Sample
065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
Resource
win7-20240903-en
General
-
Target
065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe
-
Size
76KB
-
MD5
81fcbbf335f57c98713f9ed7cbde61c0
-
SHA1
fd441e63eba1e52c49fe0a4c746cb68177af9979
-
SHA256
065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76b
-
SHA512
c9476c644af262c4c9339b82d913922e867e91994512523624cf7675db5be265ce495c7b4493e5d0ae4ce877587371acb6d2197481fe92346f65c1b197f38760
-
SSDEEP
1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11f:kdseIOMEZEyFjEOFqaiQm5l/5w11f
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Executes dropped EXE 3 IoCs
pid Process 2772 omsecor.exe 2624 omsecor.exe 1932 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 2772 omsecor.exe 2772 omsecor.exe 2624 omsecor.exe 2624 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2772 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 30 PID 2756 wrote to memory of 2772 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 30 PID 2756 wrote to memory of 2772 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 30 PID 2756 wrote to memory of 2772 2756 065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe 30 PID 2772 wrote to memory of 2624 2772 omsecor.exe 33 PID 2772 wrote to memory of 2624 2772 omsecor.exe 33 PID 2772 wrote to memory of 2624 2772 omsecor.exe 33 PID 2772 wrote to memory of 2624 2772 omsecor.exe 33 PID 2624 wrote to memory of 1932 2624 omsecor.exe 34 PID 2624 wrote to memory of 1932 2624 omsecor.exe 34 PID 2624 wrote to memory of 1932 2624 omsecor.exe 34 PID 2624 wrote to memory of 1932 2624 omsecor.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe"C:\Users\Admin\AppData\Local\Temp\065b3fb2f322d9e92e331a016e3e71302c9061925422ac41deac61fc7a34f76bN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5ae1487c3d2b7d2a7485d9bb6261708a5
SHA126e7473bb57b5f67bef435eb159bc8af269e3694
SHA256159324e1ae77e4051db840c317bd6ed04751082bb66d372f077563ec47919049
SHA5125d17ef745ad46bdd00803cda54690124936ab64e29480a2cf9961ac536d5a3bdb3d654c3012d91fde355e32bbae1a2d4582c3cc9a53805cf93a4b67d4c9c393e
-
Filesize
76KB
MD5f64ea2fa9bb76fd9e3ed2ff36e05b04a
SHA13be7d2a55f38d6775c907fcea19caf6d3582a640
SHA256acf5f3357654db076d1dd24e3bef84d9f7b4c16a07f0a742ff16c35e6bda865e
SHA51243d16429e8972fec08404737316ffee1e792120d586d5e6362986d9f10b7192d1763c1e13b6affabd66aac73cd8a99b0d13f9969a19dc5f15fe96eb39dacd6ce
-
Filesize
76KB
MD5cf966f5356fb930c5fc84a59bb8101b9
SHA1a7d40db4f8bc2e8f6a07e763f1bf177be3e3d6c7
SHA25644b7d7b927dee31cf6f9859beeff124755661be5d4c3ad6008aba6fd37a60742
SHA512e64cd9cff8f82e9e7b5f1b3a5261a74d6100f6bc633a6656c200b23ff26a1ddfeffc3cb74444d716a52973077e35eb46e1c33c0ad4adf3129c1866c42ff358c8