Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    97s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2025, 15:57

General

  • Target

    f7b9700df0f81f5d0f6cdb704f5f60980a221c5556d7356169a99f2499e7b00aN.exe

  • Size

    220KB

  • MD5

    e28b83315729e5f77ab8a812f80488a0

  • SHA1

    47c67dbc7ee98a02b1edae6216fae62169926980

  • SHA256

    f7b9700df0f81f5d0f6cdb704f5f60980a221c5556d7356169a99f2499e7b00a

  • SHA512

    70b60facc808972b786e0a043a2d1d815067fabdd69ccec487e84713bb8a2439fc11b8b4aab03faf4fcaa231cb66deaefdf7bc53964e86893350b3c4f339cbde

  • SSDEEP

    768:IfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ9p6JXXlaa5uA:IfbIvYvZEyFKF6N4yS+AQmZYl/5

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7b9700df0f81f5d0f6cdb704f5f60980a221c5556d7356169a99f2499e7b00aN.exe
    "C:\Users\Admin\AppData\Local\Temp\f7b9700df0f81f5d0f6cdb704f5f60980a221c5556d7356169a99f2499e7b00aN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 224
      2⤵
      • Program crash
      PID:2152
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 964 -ip 964
    1⤵
      PID:3848

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/964-1-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB