Malware Analysis Report

2024-09-11 08:33

Sample ID 240610-nkmj9aha4s
Target 0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
SHA256 3658b248e37384f333e7a33faaac298161802507e53f1f51e2bc35962422b152
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3658b248e37384f333e7a33faaac298161802507e53f1f51e2bc35962422b152

Threat Level: Known bad

The file 0fb181695147e200766ad32551d25370_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 11:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 11:27

Reported

2024-06-10 11:30

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3496 set thread context of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 972 set thread context of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3776 set thread context of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 448 set thread context of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3496 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 3496 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 3496 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 3496 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 3496 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2408 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 972 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 972 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 972 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 972 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 972 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3528 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3528 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3528 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3776 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3776 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3776 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3776 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3776 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5060 wrote to memory of 448 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5060 wrote to memory of 448 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5060 wrote to memory of 448 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 448 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 448 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 448 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 448 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 448 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3496 -ip 3496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 300

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 972 -ip 972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 300

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3776 -ip 3776

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 448 -ip 448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 268

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3496-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2408-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 79bafa89ec5c623d37609d3fbc31651f
SHA1 f22b4a9598078426727c389ae955df3ce0b5c20f
SHA256 2467a398627d1e6c5e07b0cab45592f161b7862ff90910c08dd57be888f51ab9
SHA512 e92fbd77eea8f4ba8987eab782840112400e8deec52eb6a9e234a8a928c2f8965cb7f2c10b8cd56fc31ae88bc3013b346b4505db26648bdafa2dedb2d089133b

memory/2408-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/972-10-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3528-13-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3528-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3496-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3528-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3528-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3528-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3528-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3528-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 3174cbb77bef4b398a4dbc218a575a22
SHA1 b77f5e6d312e4ec3067261241b5e92ee61e5b234
SHA256 c7e9b2f5ed4f1fc52e57f33e321278903cbe8d7362bfdfb9319b0f25c1442d8e
SHA512 0b7a05602e1cfe418553e5d53b6bbde0a00152dad3c9b57526da748cf970c6616be8b28182ac619268592cfc1b32103adad2529c97daf7489f735e5c7aea60e7

memory/3776-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/5060-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 598482793d6ae4d28907b7dc13ec157d
SHA1 8a9f50bc385ab154ddd1573c6d1450803ea31c66
SHA256 c79e5e0b3bccc91e9be65715a2f4b9e1b39169df6043fd15338119627bc0cfe6
SHA512 c396f1dd402f547930fc1e0a8444a7e8cbffbfbfcaea267c3c0b53e018dda2dc833005b803c5e727d4c247fad103acde50b72fad5f30ad97348ce993ddcceb82

memory/448-43-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3876-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3876-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3776-50-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3876-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3876-54-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 11:27

Reported

2024-06-10 11:30

Platform

win7-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2388 set thread context of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 set thread context of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 856 set thread context of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 2860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe
PID 1952 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1952 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1952 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1952 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2388 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2628 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 3000 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3000 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3000 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3000 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3000 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0fb181695147e200766ad32551d25370_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2860-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1952-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2860-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1952-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1952-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1952-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1952-11-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 79bafa89ec5c623d37609d3fbc31651f
SHA1 f22b4a9598078426727c389ae955df3ce0b5c20f
SHA256 2467a398627d1e6c5e07b0cab45592f161b7862ff90910c08dd57be888f51ab9
SHA512 e92fbd77eea8f4ba8987eab782840112400e8deec52eb6a9e234a8a928c2f8965cb7f2c10b8cd56fc31ae88bc3013b346b4505db26648bdafa2dedb2d089133b

memory/2388-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2388-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-46-0x00000000027D0000-0x00000000027F3000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 bd654c44b16c1e1b8af4c2cbbe078f90
SHA1 da94a47cc09c1cd888521385e07509622bf3da30
SHA256 3f2b23003b08291ed9d67334ebaab69bd5b3a00cf0b139b6e2dce5869821023e
SHA512 69218d4d61ff47c2728e6a3e4d1ff4c08a3aec4ef0a48a3fc6fc782e744b06cede786dddb896edc5fa344dd16c73b702943b43198bef40f7252adc271edbee48

memory/2628-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1708-63-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2a42868c285a7dbed49cc9bc204f86f8
SHA1 90b9f50bb4d4b0a182fadbd3163379a31a31b477
SHA256 6899602c8b7563bfbb085629f282d37961e7ea4bddf4b624ee51ed438528a911
SHA512 603951136c76496d6548a765fd31fbcc5c724682ef10e15086f051ea5969bbe0329b5f4f6ca18c44fd0885f2292e81ccb29e97378e83cdf63c501a3209128015

memory/856-76-0x0000000000400000-0x0000000000423000-memory.dmp

memory/856-84-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1300-86-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1300-89-0x0000000000400000-0x0000000000429000-memory.dmp