neconyd | ce6dcd03846e7a742ec10d2b98b3ce67b95866774e358bbe9d92d029fd865412

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 10:37

Target
2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe
Size 3.2MB
Sample240708-mnxc7axdlc
SHA256 ce6dcd03846e7a742ec10d2b98b3ce67b95866774e358bbe9d92d029fd865412
MD5 2c01e04e61364f54bf9c985f9f53de1d
SHA1 88c5d144fc89f06f6f4ab581e4d6bbb532f36d2f
SHA512 f39c12866cd2ff738b91a5479e9e9a9e690e8500109c83bdedeac779107023b3c2d47a52672660d80d00661c08e94c9861b76e7b06b4c7a7310d9ae42c1b4f8d
SSDEEP 24576:dOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:I6W+TFq6IZj8N2Y7T5GF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Executes dropped EXE 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2256	1728	2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe	90
PID 1728 wrote to memory of 2256	1728	2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe	90
PID 1728 wrote to memory of 2256	1728	2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe	90
PID 2256 wrote to memory of 4336	2256	omsecor.exe	97
PID 2256 wrote to memory of 4336	2256	omsecor.exe	97
PID 2256 wrote to memory of 4336	2256	omsecor.exe	97
PID 4336 wrote to memory of 560	4336	omsecor.exe	98
PID 4336 wrote to memory of 560	4336	omsecor.exe	98
PID 4336 wrote to memory of 560	4336	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c01e04e61364f54bf9c985f9f53de1d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,384704133665252524,7723904513810765818,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:64

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 e9e6e89b5489a19e9437d68132f834aa75cfc28a2096f6a23bfc26f321c12dbb
MD5 3ce8bb9eb15920f67b0d2697242a4262
SHA1 2e22d00aae10279c961ccebf25f2a55995b976ea
SHA512 56e95b9168b39377eaca7245441de4cc758c2045c6de951f32f1c8a37c0579559e77b25c0fb57ce94f0d08fa6f865806772b5305c5c0a4294f31151d143cd45b
SSDEEP 24576:cOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:d6W+TFq6IZj8N2Y7T5GF
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 e7b5de0b6da4872a1c78f25b49a239e5e851c242ee7c4df1270333ebed1783b6
MD5 0499079199fed6622c9744c428aba797
SHA1 75a881ddbe22ed6aa5ca98b5c06f7f41ab6fbfe8
SHA512 d06dc177e445d6e817d3c36d301ef3d8ee5e5f4ddb6a8a66d50b583fc6915b73635eeb89fad6590566f73a0d810b0d9d4866047fd52e6f56b29bf364b2329605
SSDEEP 24576:dOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:I6W+TFq6IZj8N2Y7T5GF
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 e2610d284ed9e870f8f2bedcf3079c5be36fbd4031298410970a5678e8881ad8
MD5 1fcaf1a885183e5a850007528073802a
SHA1 32b4bbdbccb0b7161960097d34cdb2019b1ebe2d
SHA512 e3a594e3da3f15cd2da67a5776874d99aa7718e75be612ce46a41a999765428f78bf2d66c3457418be3340186e54013b2cc7286dfe63fd2d5584efb7a9e77026
SSDEEP 24576:QOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:56W+TFq6IZj8N2Y7T5GF
MD5 SHA1 SHA512 SSDEEP

Submit Download