Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0ea0473e79...cs.exe

windows7-x64

10

0ea0473e79...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 14:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe

  • Size

    89KB

  • MD5

    0ea0473e79c565198836f8c68397e1d0

  • SHA1

    04a460382a2ca31bc366932cc17f66fdcc9249bc

  • SHA256

    04bf2f640affb7d4a6c6f2fd8644471301a9b0f0f4d0b6407b55f5784db6bb06

  • SHA512

    5ce411f784e9b52fd1a743bb6449a5ba6f8fd1404fe0a23fdf48dd844a26f050898a48e64faa7c20bcd3378760bf69dc344868224fd499b0f79299a11be68bfb

  • SSDEEP

    768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZTl/5

Score
10/10
neconydtrojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

    trojanneconyd
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:1280

Network

  • flag-us
    DNS
    lousta.net
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    lousta.net
    IN A
    Response
    lousta.net
    IN A
    193.166.255.171
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=02DD4DD7194D650F0B1359AB18F6640E; domain=.bing.com; expires=Thu, 05-Jun-2025 14:32:53 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 43FDAA0F2FC5460582C3207048D48645 Ref B: LON04EDGE0818 Ref C: 2024-05-11T14:32:53Z
    date: Sat, 11 May 2024 14:32:52 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=02DD4DD7194D650F0B1359AB18F6640E; _EDGE_S=SID=0AB0ACA426076B4427A7B8D827506A57
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=3I9IvJ8YVWiAHYsUWdvKgm2EYN__bN7s1mUHdJLBcj8; domain=.bing.com; expires=Thu, 05-Jun-2025 14:32:53 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4C922D8B75AE4270AB20097321DB1C5F Ref B: LON04EDGE0818 Ref C: 2024-05-11T14:32:53Z
    date: Sat, 11 May 2024 14:32:53 GMT
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.58.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.58.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    GET
    https://www.bing.com/aes/c.gif?RG=c38c3b852d5a4296ac71156ec05f5144&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T132730Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    Remote address:
    23.62.61.113:443
    Request
    GET /aes/c.gif?RG=c38c3b852d5a4296ac71156ec05f5144&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T132730Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=02DD4DD7194D650F0B1359AB18F6640E
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0770F33E9C3F4AAB917CFCCAE495050D Ref B: AMS04EDGE1115 Ref C: 2024-05-11T14:32:53Z
    content-length: 0
    date: Sat, 11 May 2024 14:32:53 GMT
    set-cookie: _EDGE_S=SID=0AB0ACA426076B4427A7B8D827506A57; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=02DD4DD7194D650F0B1359AB18F6640E; path=/; httponly; expires=Thu, 05-Jun-2025 14:32:53 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.6d3d3e17.1715437973.51f1f6d
  • flag-us
    DNS
    113.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    113.61.62.23.in-addr.arpa
    IN PTR
    Response
    113.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-113deploystaticakamaitechnologiescom
  • flag-nl
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    23.62.61.113:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=02DD4DD7194D650F0B1359AB18F6640E; _EDGE_S=SID=0AB0ACA426076B4427A7B8D827506A57; MSPTC=3I9IvJ8YVWiAHYsUWdvKgm2EYN__bN7s1mUHdJLBcj8; MUIDB=02DD4DD7194D650F0B1359AB18F6640E
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Sat, 11 May 2024 14:32:55 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.6d3d3e17.1715437975.51f2675
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    142.53.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    142.53.16.96.in-addr.arpa
    IN PTR
    Response
    142.53.16.96.in-addr.arpa
    IN PTR
    a96-16-53-142deploystaticakamaitechnologiescom
  • flag-us
    DNS
    mkkuei4kdsz.com
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    mkkuei4kdsz.com
    IN A
    Response
    mkkuei4kdsz.com
    IN A
    64.225.91.73
  • flag-us
    GET
    http://mkkuei4kdsz.com/357/366.html
    omsecor.exe
    Remote address:
    64.225.91.73:80
    Request
    GET /357/366.html HTTP/1.1
    From: 133599115712981385
    Via: emohgso\sgt>9.6`apfc>7\qcpbo;22.1213`mt?432/_mcz?_2fcdgaf5.336780g4_17_97d3747d01
    Host: mkkuei4kdsz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    server: nginx/1.18.0 (Ubuntu)
    date: Sat, 11 May 2024 14:33:54 GMT
    content-type: text/html
    content-length: 593
    last-modified: Wed, 22 Feb 2023 21:25:52 GMT
    etag: "63f68860-251"
    accept-ranges: bytes
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.91.225.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.91.225.64.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ow5dirasuek.com
    omsecor.exe
    Remote address:
    8.8.8.8:53
    Request
    ow5dirasuek.com
    IN A
    Response
    ow5dirasuek.com
    IN A
    34.41.229.245
  • flag-us
    GET
    http://ow5dirasuek.com/521/713.html
    omsecor.exe
    Remote address:
    34.41.229.245:80
    Request
    GET /521/713.html HTTP/1.1
    From: 133599115712981385
    Via: emohgso\sgt>9.6`apfc>7\qcpbo;22.1213`mt?432/_mcz?_2fcdgaf5.336780g4_17_97d3747d01
    Host: ow5dirasuek.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sat, 11 May 2024 14:34:05 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=7c493f5f72ac91cfd6f04f7e0186d033|191.101.209.39|1715438045|1715438045|0|1|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=191.101.209.39; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    DNS
    245.229.41.34.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    245.229.41.34.in-addr.arpa
    IN PTR
    Response
    245.229.41.34.in-addr.arpa
    IN PTR
    2452294134bcgoogleusercontentcom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 499516
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4D1796FBBAAB4EBA9D6918826932BC3B Ref B: LON04EDGE1105 Ref C: 2024-05-11T14:34:33Z
    date: Sat, 11 May 2024 14:34:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 476246
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 593A2DD0045C4802BDB10119D4231B13 Ref B: LON04EDGE1105 Ref C: 2024-05-11T14:34:33Z
    date: Sat, 11 May 2024 14:34:32 GMT
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    http://mkkuei4kdsz.com/922/515.html
    omsecor.exe
    Remote address:
    64.225.91.73:80
    Request
    GET /922/515.html HTTP/1.1
    From: 133599115712981385
    Via: emohgso\sgt>9.6`apfc>7\qcpbo;22.1213`mt?432/_mcz?_2fcdgaf5.336780g4_17_97d3747d01
    Host: mkkuei4kdsz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    server: nginx/1.18.0 (Ubuntu)
    date: Sat, 11 May 2024 14:35:17 GMT
    content-type: text/html
    content-length: 593
    last-modified: Wed, 22 Feb 2023 21:25:52 GMT
    etag: "63f68860-251"
    accept-ranges: bytes
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    260 B
     5
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    tls, http2
    2.5kB
     9.0kB
     20
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8joFT3ggLLo-mpS8t_inkczVUCUwXPUZX483Kbzw1SI5nJdviYt4rTYKYR3Q-RR_vEaGpoIoFwHcCESvHd0YPOzZXu-scEqQKG6fFuqf33kSXJ0ZAf3FPLvEgWY79W54FexsqNwC4OPlu5MD0XDJpzQkV3erQFW-zNNhx8fTRPKadwa_-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De045328104ee1643793954aaaf4a036e&TIME=20240426T132730Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204
  • 23.62.61.113:443
    https://www.bing.com/aes/c.gif?RG=c38c3b852d5a4296ac71156ec05f5144&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T132730Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    tls, http2
    1.5kB
     5.4kB
     17
    12

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=c38c3b852d5a4296ac71156ec05f5144&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T132730Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038

    HTTP Response

    200
  • 23.62.61.113:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.7kB
     6.4kB
     18
    13

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    260 B
     5
  • 64.225.91.73:80
    http://mkkuei4kdsz.com/357/366.html
    http
    omsecor.exe
    421 B
     948 B
     5
    3

    HTTP Request

    GET http://mkkuei4kdsz.com/357/366.html

    HTTP Response

    200
  • 34.41.229.245:80
    http://ow5dirasuek.com/521/713.html
    http
    omsecor.exe
    513 B
     623 B
     7
    5

    HTTP Request

    GET http://ow5dirasuek.com/521/713.html

    HTTP Response

    200
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    260 B
     5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    35.2kB
     1.0MB
     742
    738

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 193.166.255.171:80
    lousta.net
    omsecor.exe
    260 B
     5
  • 64.225.91.73:80
    http://mkkuei4kdsz.com/922/515.html
    http
    omsecor.exe
    375 B
     948 B
     4
    3

    HTTP Request

    GET http://mkkuei4kdsz.com/922/515.html

    HTTP Response

    200
  • 8.8.8.8:53
    lousta.net
    dns
    omsecor.exe
    56 B
     72 B
     1
    1

    DNS Request

    lousta.net

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    99.58.20.217.in-addr.arpa
    dns
    71 B
     131 B
     1
    1

    DNS Request

    99.58.20.217.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    75.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    75.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    113.61.62.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    113.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    142.53.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    142.53.16.96.in-addr.arpa

  • 8.8.8.8:53
    mkkuei4kdsz.com
    dns
    omsecor.exe
    61 B
     77 B
     1
    1

    DNS Request

    mkkuei4kdsz.com

    DNS Response

    64.225.91.73

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    73.91.225.64.in-addr.arpa
    dns
    71 B
     138 B
     1
    1

    DNS Request

    73.91.225.64.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    ow5dirasuek.com
    dns
    omsecor.exe
    61 B
     77 B
     1
    1

    DNS Request

    ow5dirasuek.com

    DNS Response

    34.41.229.245

  • 8.8.8.8:53
    245.229.41.34.in-addr.arpa
    dns
    72 B
     124 B
     1
    1

    DNS Request

    245.229.41.34.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe
    Filesize

    89KB

    MD5

    09cf74efe8433fe597ba0732886da3f9

    SHA1

    5b6c845a6904a361142d209abd36b17f7b94d3b9

    SHA256

    e8f1c98b009571c3a9fe229a7565cc625bf8851cb3daaa163474c968b33919e7

    SHA512

    d7980b9b0e2fc2c2ea666ce418573e6e22ad87d7d04c20ca4ab743c86a2fa4b8b58315fcfab28da9d2aaffd9ef66aba6a06626c94327578f190e0970afa4cdfa

    Download Submit

  • C:\Users\Admin\AppData\Roaming\omsecor.exe
    Filesize

    89KB

    MD5

    f1327f1f7b510583e3a8586aded218ca

    SHA1

    6400a002af63ddf9aa8514847429a19f47bda0bd

    SHA256

    ad4bed6f81d60f9bbbb4d391f294c06f92947a89bf343f4b8fa62f7ef9266016

    SHA512

    6759c348adb21d21fefe2d2a3da8a34b2840bebda0394022929ded7f0c9bd079fc65e179b8fcd21ddebd1684cd868a359c1421cba2c0ec4fc3a0abcfab82f4dd

    Download Submit

  • C:\Windows\SysWOW64\omsecor.exe
    Filesize

    89KB

    MD5

    518f0548036ce21f2b6896de8179197c

    SHA1

    ed98d1ea4ccdef946123a6d662ae9e9e622a8f79

    SHA256

    e9a33912349876fb3b7f0de8b4356b5846650ab9124dbb715d3be130c752b7e4

    SHA512

    47e636efa4a718a3730ff451db1a99c5f97006533e2247cd227b157857fe742e53a9919c76c4393b10e08f372737bbc6e8b1dfc3a359cf4d4a0ba578cb6aced5

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.