Malware Analysis Report

2024-09-11 08:37

Sample ID 240609-j5x49sga51
Target 17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
SHA256 cb02fa7466189f81d6f0aa2bd844f71646022ae413ea4043dac19b065e0f4163
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cb02fa7466189f81d6f0aa2bd844f71646022ae413ea4043dac19b065e0f4163

Threat Level: Known bad

The file 17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 08:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 08:15

Reported

2024-06-09 08:22

Platform

win7-20240221-en

Max time kernel

85s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1984 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 2172 set thread context of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 set thread context of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1332 set thread context of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1984 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1616 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1616 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1616 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1616 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2584 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 wrote to memory of 2232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2232 wrote to memory of 1332 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 1332 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 1332 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 1332 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1332 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1984-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1984-1-0x0000000000240000-0x0000000000263000-memory.dmp

memory/1616-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1616-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1984-9-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1616-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1616-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1616-12-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 236525cad0fd80992807c1f8b6eef799
SHA1 133e1d0b2a9cc7ba21a8fa52241bf781c349fc0f
SHA256 ea5142b53fa42bbdbd3ab4fb2d0228202e40aa0d53aabf7336b69e37c53322c1
SHA512 1054059a0a81f2efc101e843dca6186e43980c92eb265ea503cae5c80bc004638b55dcd6aed492371d18e7566195b6390a7a19e651f2a12aaa21c1714a072280

memory/2172-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2172-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2172-34-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/2584-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-42-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 2b6173856b4677aaafc776d6e41ccb15
SHA1 efcab6bb838dd133e8fc2a1dbdb986c6d05bd1ca
SHA256 c6550cafb88467acea38cc2fccdef17647426aba4968d61f026b1af1e2cdc62b
SHA512 7e9d4800c0c71f50a1d19343fda7e032c2e6ef49816df170bfdc3655b558f6a141ae4ff1e04150af015564e95d1328ac9b1c2ddd3f9d99c297db4eee14ea03e2

memory/1908-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1332-81-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 df981405c516cb91e906111788f300e7
SHA1 11f563dc5e8a881e86245ec02a4cb0814a7867d5
SHA256 ce4e32bdaa24fb942ce23528b7f779086446269645719a243cd72bf5a9284273
SHA512 8c26bbefe513922341663ad1154742580afd1d6129aa73664df9026cc9dcc5759af4394fa4483e3e54afbbab25689f72029789c438493919dfaf43744a94b85a

memory/1332-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-73-0x0000000000230000-0x0000000000253000-memory.dmp

memory/1908-67-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2584-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-48-0x00000000002C0000-0x00000000002E3000-memory.dmp

memory/2128-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2128-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 08:15

Reported

2024-06-09 08:22

Platform

win10v2004-20240426-en

Max time kernel

86s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3084 set thread context of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 1100 set thread context of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 364 set thread context of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2468 set thread context of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3084 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 3084 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 3084 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 3084 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 3084 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe
PID 764 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 764 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 764 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1100 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1100 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1100 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1100 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1100 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2308 wrote to memory of 364 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2308 wrote to memory of 364 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2308 wrote to memory of 364 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5060 wrote to memory of 2468 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5060 wrote to memory of 2468 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5060 wrote to memory of 2468 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\17415538c00d202a5cb4e0169cf83f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3084 -ip 3084

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1100 -ip 1100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 296

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 364 -ip 364

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2468 -ip 2468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3084-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/764-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/764-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/764-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/764-7-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 236525cad0fd80992807c1f8b6eef799
SHA1 133e1d0b2a9cc7ba21a8fa52241bf781c349fc0f
SHA256 ea5142b53fa42bbdbd3ab4fb2d0228202e40aa0d53aabf7336b69e37c53322c1
SHA512 1054059a0a81f2efc101e843dca6186e43980c92eb265ea503cae5c80bc004638b55dcd6aed492371d18e7566195b6390a7a19e651f2a12aaa21c1714a072280

memory/1100-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2308-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2308-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3084-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2308-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2308-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2308-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2308-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/364-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/5060-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2468-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3552-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/364-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3552-48-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d70e45eea8cf7048f765ad3edaa6c831
SHA1 498772cefe809be004e9a984ba7b604d5a1e44ce
SHA256 00a7509e41b141c4cf11c9b621bfb640733af36a56e131f4141a38fc744f1859
SHA512 41351f94c743da55ee3ba183527b1756a04d163a4a3508f685d4fb090f25e3e56828ac1e681b23481ecc40f647a2520c7c968a8d9d611cc13e59e65a1f772c8a

memory/5060-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-36-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 ce1f497a363496629ddbe3fcc95a784b
SHA1 b406cdbc64876494ba89469fb1732c2cc9c84a39
SHA256 7ce4814268c083828771204270e2527bc9f175297f39a39fefbd40090f03d29b
SHA512 e5fd9c7c6c346c846692b39731d19337a91be26654339360446096640c1ee3ef1a21c4f700729b2ce6d9374f3975779ab0407b00274aec7a36766288a86a840b

memory/2308-30-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3552-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3552-56-0x0000000000400000-0x0000000000429000-memory.dmp