Malware Analysis Report

2024-11-16 13:01

Sample ID 240524-gwalhaga24
Target 25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
SHA256 d55f838809aff14c14a807c5a6620134ef17dc4c7091af6b5095722a16408961
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d55f838809aff14c14a807c5a6620134ef17dc4c7091af6b5095722a16408961

Threat Level: Known bad

The file 25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-24 06:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 06:08

Reported

2024-05-24 06:11

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1120 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 1120 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 1120 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 1120 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 1120 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2128 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2128 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2128 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3512 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3512 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3512 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3512 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3512 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4828 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4828 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4828 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 1288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 1288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 1288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 1288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4072 wrote to memory of 1288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1288 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1288 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1288 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1120 -ip 1120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3512 -ip 3512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4072 -ip 4072

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1444 -ip 1444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1120-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2128-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2128-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2128-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2128-7-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 347e4d792dee83cfd14d5394577dfe8a
SHA1 7a2994120140b0daccce2084a942461579d54f77
SHA256 ca1c24d63efff269d82a4277ca4147f6efa2a53847213477c537e350a146f828
SHA512 5d9b0588f25469b4af9fde6192f1fdb72b5146774ec3e28ce65cf5aed3096983ff926fd59fa7c9a0da06d8af0a5bc0bc1b5ffe578de8fc72ba0b1964818660c5

memory/3512-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4828-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3512-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4828-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-26-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 1638a3ab1e706a060000027093f51f3e
SHA1 9d29f0c62506cdf848eaeb01c8589d13ccc2e0b1
SHA256 919fcb63eeb7d01b9a72338d3c7cdcce67e2116347fe9e0a1084db0ef68b18a7
SHA512 dfca24d01a6cc7c53f5513f4acbb861c77db9f1b0c724290fd6305d9fbfd5b516693cc7917840a1d1bd18b6ad77392c0892c492a47f1b11f9440d4cbc70c5a92

memory/4828-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4072-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1288-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1288-40-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fe8d9fb1e95d914a414eb8549a5e5c7e
SHA1 32d7c651e322b62c6c786454f44b0f0f1d3a6dce
SHA256 9b9c46668b3ef62316bf11326beaba9c53636478dc928232a2b1b00b2d53b86c
SHA512 10d928cd99d47efe4afa1f4289d7cfb89cc5efa8ff01c0b9a9c8893d0c5c0638487b7e2d027ad156001ce2758863b9a8333f03f271a48b4b6921082fa8c49d58

memory/1288-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1444-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2944-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2944-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4072-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1444-54-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2944-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2944-58-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 06:08

Reported

2024-05-24 06:11

Platform

win7-20240221-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2916 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
PID 2948 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2948 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2948 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2948 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2268 wrote to memory of 688 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 688 wrote to memory of 2032 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 688 wrote to memory of 2032 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 688 wrote to memory of 2032 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 688 wrote to memory of 2032 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2032 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2076-33-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 347e4d792dee83cfd14d5394577dfe8a
SHA1 7a2994120140b0daccce2084a942461579d54f77
SHA256 ca1c24d63efff269d82a4277ca4147f6efa2a53847213477c537e350a146f828
SHA512 5d9b0588f25469b4af9fde6192f1fdb72b5146774ec3e28ce65cf5aed3096983ff926fd59fa7c9a0da06d8af0a5bc0bc1b5ffe578de8fc72ba0b1964818660c5

memory/2076-23-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2948-15-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2916-12-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2948-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-10-0x0000000000260000-0x0000000000283000-memory.dmp

memory/2948-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2948-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2948-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2948-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2588-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2588-42-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2588-45-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 bc3409e79fe026516be95bb1c3e17d39
SHA1 4c428257e481482ae6ba7744c2f3bb21879df763
SHA256 d192b55f54cf6b2f42ba1452255349721314d642e2130b7522e6e19188c0d514
SHA512 a16d49b166038a1a19aa1b6aaf74ab98af912431112c161168644d2d9b912ee3858d89b7793a53dec5faa1abd6c6e03b34a6acdb876579c21ddc8ae22443e7d8

memory/2588-48-0x0000000000290000-0x00000000002B3000-memory.dmp

memory/2588-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2268-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2268-67-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d1f92ba093d27549b6683e34cff011f3
SHA1 b6b4fcf5cf4ee295b9d5498ac15389941c13c3d0
SHA256 e6c65182352f7bce38798af9de7bf6ef864f7fcdd731f1f4291dd491d95f53c1
SHA512 0d28591c534954631a36939373c843765039da57b7ef26063638456b3ae9f08061a55f69cd61f8277eaba46b52b86a7a3b2746eff2a402238584612b664bba34

memory/2032-80-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2032-88-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2800-90-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2800-93-0x0000000000400000-0x0000000000429000-memory.dmp