Malware Analysis Report

2024-09-11 08:35

Sample ID 240610-ra9htayflm
Target 18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
SHA256 95466c263a6855472fa597263d5114f73222508d09de7bd999641ac459e7567c
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

95466c263a6855472fa597263d5114f73222508d09de7bd999641ac459e7567c

Threat Level: Known bad

The file 18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 14:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 14:00

Reported

2024-06-10 14:03

Platform

win7-20240215-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1656 set thread context of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 2884 set thread context of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1740 set thread context of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2392 set thread context of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 1656 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 380 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 380 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 380 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 380 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2556 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1740 wrote to memory of 2044 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2044 wrote to memory of 2392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2044 wrote to memory of 2392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2044 wrote to memory of 2392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2044 wrote to memory of 2392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2392 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1656-0-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d18d566b62401a7488085c786d75f261
SHA1 47440e778aaa036d474977f19d134973ed4d1716
SHA256 de5602afc0c4394bb738283621ac8de17eecf86514780b83f9e26676de97b8f1
SHA512 02348da35ed62bc6e9eda6a2e5751f1797857a72f5e09d1a1d8d1252a73e337a046aadf255abd723fed5a10b5651597ca7abb42246b8bec440b1e8dd893d10c1

memory/380-14-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/380-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1656-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/380-13-0x0000000000400000-0x0000000000429000-memory.dmp

memory/380-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/380-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/380-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2884-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2884-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2556-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2556-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2556-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2556-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 2231469ca64eb56261d234301e68e2bb
SHA1 b0512a51b314b4899154a653d2d8aaf97fb70e8e
SHA256 58a8c450cc3b8e5b4ac1c3be2efc7bba55974322c44026153186d0ca16073f57
SHA512 909a6aa8e8e3b2afb2fe2c0cf5cedba271ec3419735c454ddd2be5f6709b5b0c6194b4029a697fa10f2d6d54e5f979af0fd2e8bcdd2ab1c01dbf21460f7ae4f8

memory/2556-47-0x0000000001FD0000-0x0000000001FF3000-memory.dmp

memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1740-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1740-66-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b923fb12c80370cfbd1c53a1500c1c6f
SHA1 b0b10bfa2e7854653b9ea64ee3fdf690e5656a04
SHA256 2ebf7bb5f93eecfbeb73d8ccd2e8cb58ca8d56d1f4ddd3c8bc3a5140741e1dff
SHA512 1f466ebf30719c4601d33a5505e88801d801a8c9c4597d7c056f8ea69d1a10ccb7ddf1184097a11b5538fa5be9baa590a1d63e152b0054f8f0951dc49ba2cfc4

memory/2392-79-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2392-87-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1900-89-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1900-92-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 14:00

Reported

2024-06-10 14:03

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 744 set thread context of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 2136 set thread context of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 set thread context of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 set thread context of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 744 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 744 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 744 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 744 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 744 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe
PID 116 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 116 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 116 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2136 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2136 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2136 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2136 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2136 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2348 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2348 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2348 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 wrote to memory of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 wrote to memory of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 wrote to memory of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 wrote to memory of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 wrote to memory of 3284 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3284 wrote to memory of 4524 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3284 wrote to memory of 4524 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3284 wrote to memory of 4524 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\18ea01866023499ee0a46c5985fd4870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 744 -ip 744

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2136 -ip 2136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3648 -ip 3648

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4524 -ip 4524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/744-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/116-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/116-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/116-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/116-8-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d18d566b62401a7488085c786d75f261
SHA1 47440e778aaa036d474977f19d134973ed4d1716
SHA256 de5602afc0c4394bb738283621ac8de17eecf86514780b83f9e26676de97b8f1
SHA512 02348da35ed62bc6e9eda6a2e5751f1797857a72f5e09d1a1d8d1252a73e337a046aadf255abd723fed5a10b5651597ca7abb42246b8bec440b1e8dd893d10c1

memory/2136-9-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2348-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2348-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2136-20-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2348-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2348-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2348-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 a92bcee4edbc4b5c5c972d7d500fbf62
SHA1 94c66d1095cc86623b05d8dfd710e1936bac4838
SHA256 6836227b31c9a2479c99e8aa3b6157d6baa153613409fadbb856305fcc928ce0
SHA512 ad6ce971066174ad76d8a6fe51a87b0a045c8329ba6ab7c8a94ad3ba74f0215fd061d650a0fc29a0338a77e6e1f84d973201430701e779536c22d39af1d6f263

memory/3648-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3284-37-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0f990279b664424e4d1156afffa5b233
SHA1 f47aa08821258a364c0d6c44879f41936e8be3fa
SHA256 d6892ccdb02a7234b5765a87094942b2d045e0fe517e7ab324a1d9874a472766
SHA512 6c7455a5a764c84db8342f9a681ae5ba1083265a156f51f97e505042e21f7e036f34e24a66d8bad0aa2b9b0cddd327879b0643f18b7046fb6b2e64255799776b

memory/4524-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3284-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3284-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3328-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3328-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4524-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3328-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3328-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3328-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3328-58-0x0000000000400000-0x0000000000429000-memory.dmp