Malware Analysis Report

2024-09-11 08:40

Sample ID 240611-b8mhyazbmf
Target 2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
SHA256 5151af7c06ba39bcf7f840890c95a00565acd0bd6db09a2d5187966ed624e74c
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5151af7c06ba39bcf7f840890c95a00565acd0bd6db09a2d5187966ed624e74c

Threat Level: Known bad

The file 2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 01:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 01:48

Reported

2024-06-11 01:51

Platform

win7-20240215-en

Max time kernel

141s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2916 set thread context of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2532 set thread context of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2872 set thread context of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2072 set thread context of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2916 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 2720 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2720 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2720 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2720 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2532 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2584 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2584 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2872 wrote to memory of 1048 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1048 wrote to memory of 2072 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1048 wrote to memory of 2072 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1048 wrote to memory of 2072 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1048 wrote to memory of 2072 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2072 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/2916-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2720-1-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1256512daf4525f6512d632e7bfca600
SHA1 617d1b91305e576fe6f5dca7e72ce578ed6eee5d
SHA256 2e944efaceaf57c01c33f6fa631f24f9bc899574b184c0b2b2e7bff8bd3be641
SHA512 d2859000933d15476884ff3677b97bac03dd18189a54ee2c77f2a952d3e5db8ccb39a824c6720f7c6b94d638ded4c6917e8253335eb7e0b4fe50ecfad2dd45d8

memory/2720-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2720-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2532-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2532-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 b57b85b78ee1a2f027883f98935035df
SHA1 59c59ce2a88a96ca7d88afa22f73f758b786c2c3
SHA256 1969b7f1744bb13dec055ca4f12502ef3c14567d12c9def8934300df91bde244
SHA512 2f2c421100fa9d4ce5b26a0e21f671f8c23f1a717e514e6812fc7b417b1cc6b12c10d614a379ccb608590908899e31e69d6f1b419cb71a26e44ea595927f0bf6

memory/2584-48-0x00000000002F0000-0x0000000000313000-memory.dmp

memory/2584-57-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2872-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2872-68-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7eabd4ffee7ce984049dbfb7cf255754
SHA1 117ef9249c7702adc5a24347710d8d047a8f5d9a
SHA256 b5a1c06982ff5e40c3a5c9c6dfc2fac61b32bcc5e247eeb3fcfd84881502d8db
SHA512 7b17478fb299ab5c40a5fb98e147c1199c566d00f285438820a82c2c0902f3dd9133187db797ee660eb0079f0d6f4e875adc4f9a969f49973ec6dc191890ea8e

memory/1048-73-0x0000000000430000-0x0000000000453000-memory.dmp

memory/2072-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2072-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2068-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 01:48

Reported

2024-06-11 01:51

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3220 set thread context of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 1652 set thread context of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 324 set thread context of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3124 set thread context of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3220 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 3220 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 3220 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 3220 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 3220 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe
PID 1472 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1472 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1472 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4764 wrote to memory of 324 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4764 wrote to memory of 324 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4764 wrote to memory of 324 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 324 wrote to memory of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 324 wrote to memory of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 324 wrote to memory of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 324 wrote to memory of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 324 wrote to memory of 392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 392 wrote to memory of 3124 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 392 wrote to memory of 3124 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 392 wrote to memory of 3124 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3124 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3124 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3124 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3124 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3124 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2325edd99bbbea352d79e56d883a4740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3220 -ip 3220

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1652 -ip 1652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 324 -ip 324

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3124 -ip 3124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/3220-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1472-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1472-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1472-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1472-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1256512daf4525f6512d632e7bfca600
SHA1 617d1b91305e576fe6f5dca7e72ce578ed6eee5d
SHA256 2e944efaceaf57c01c33f6fa631f24f9bc899574b184c0b2b2e7bff8bd3be641
SHA512 d2859000933d15476884ff3677b97bac03dd18189a54ee2c77f2a952d3e5db8ccb39a824c6720f7c6b94d638ded4c6917e8253335eb7e0b4fe50ecfad2dd45d8

memory/1652-10-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4764-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3220-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1652-20-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4764-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 08cb7171f75e96a30fda04be22b75aa2
SHA1 aa80ef8ca815ad718a93f7a2d3fe8be3db6017ce
SHA256 ea1d687e814d570e864dc2a4829a5e0656b44389bafbc0e1426258502f9b1d27
SHA512 ed9d93fd664be9a93574774717af5bf3339229d3aabbdba1a235eae17c55a5c8b5f00a5746f6ea6b77c011bcea6af3b5a42e90d89e5c7f7c344752ddce7c5924

memory/324-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/392-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/392-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/392-36-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2457cb8fac82d6e6dc144568a9bde95c
SHA1 920470114934f89765befcb15a8f1662e830fa7b
SHA256 453d015c5a9cdfa26be1f919b9ad37c947377ec7d4e0a88fcadaa0d92dd1d4cc
SHA512 00c598e006bedad1cc35ea1859c62bf519e726c333487b660bd2ed00d750b6e88417728c3029a7f767c6c1c34c7d795f14b4d35c5e33d4a748266481ebeb6a3d

memory/3124-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/324-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-58-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-60-0x0000000000400000-0x0000000000429000-memory.dmp