Malware Analysis Report

2024-09-11 08:40

Sample ID 240612-lgc6asxdmg
Target 2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
SHA256 ffb0035fbda15a28463f8fe13a6c32d82e64677288eefe3bdd07a0a57d64b8eb
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ffb0035fbda15a28463f8fe13a6c32d82e64677288eefe3bdd07a0a57d64b8eb

Threat Level: Known bad

The file 2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 09:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 09:29

Reported

2024-06-12 09:32

Platform

win7-20240220-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2960 set thread context of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2724 set thread context of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 308 set thread context of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1400 set thread context of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2960 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 2200 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2200 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2200 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2200 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2552 wrote to memory of 308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2552 wrote to memory of 308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2552 wrote to memory of 308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2552 wrote to memory of 308 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 308 wrote to memory of 2736 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2736 wrote to memory of 1400 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 1400 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 1400 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 1400 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1400 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2960-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2200-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2200-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2200-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2200-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2960-7-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2200-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 df6a9ead8c281d772c94656ca5db8c03
SHA1 66b48a01b8fb6bf939f292e23e29b11f86ac15bc
SHA256 64ee4b59f33ee5aa6bad2f47618f2375b935b98d0159bf7740b48cefe2a1e338
SHA512 ed4222e6ef062ba4b5497f0af230306ed857cc17b3d1f06bd54564cda1eb79caef26d3749b8962ed1b79a0726cde1d1d828e23936b10223590191d5436e3483f

memory/2724-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2724-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2552-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2552-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2552-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2552-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 36167ee72189fd8e4e7d274e6cd0ab0b
SHA1 31115dc5b80390d05cbaa2e645487c8817f7b2eb
SHA256 e6cdd06494f97b330ee21b6933393ad43d44ccb868eca5fa8183e01897e8dd68
SHA512 3c6069b8d2dacb715a7c6f811951f99bd5b5ae0bc1788205c7fd27968ee3bc81316367fc8950468b85a83de694b2994b956bc3dc4faed720b793162d4978f7b6

memory/2552-45-0x0000000000530000-0x0000000000554000-memory.dmp

memory/2552-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/308-62-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8e6b74722c0a371811a9b23c556ecf52
SHA1 bdf4604fe0375028754383adf9b003f53a08b115
SHA256 1efc51f5e7c318cc0b4507d91b01f535c370367c97830ec4aaecd6ea351db83b
SHA512 e01baa4b697c9f333a71ecfeed4d09822473a012ff37f8e64a1993eea74df9dbb0f6c3eda58681702703a2b11ceb9fdd1aac03259eb09cf268d7b40e1b60c0b1

memory/1400-75-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1400-82-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1768-84-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1768-87-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 09:29

Reported

2024-06-12 09:32

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1244 set thread context of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 4016 set thread context of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 set thread context of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1652 set thread context of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 1244 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 1244 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 1244 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 1244 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe
PID 1580 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1580 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1580 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4016 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4016 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4016 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4016 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4016 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2196 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2196 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2196 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 4344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4344 wrote to memory of 1652 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4344 wrote to memory of 1652 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4344 wrote to memory of 1652 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1652 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2f1c92b9025aceb6a2626ba0926599a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1244 -ip 1244

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4016 -ip 4016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1996 -ip 1996

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1652 -ip 1652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/1244-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1580-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1580-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1580-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1580-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 df6a9ead8c281d772c94656ca5db8c03
SHA1 66b48a01b8fb6bf939f292e23e29b11f86ac15bc
SHA256 64ee4b59f33ee5aa6bad2f47618f2375b935b98d0159bf7740b48cefe2a1e338
SHA512 ed4222e6ef062ba4b5497f0af230306ed857cc17b3d1f06bd54564cda1eb79caef26d3749b8962ed1b79a0726cde1d1d828e23936b10223590191d5436e3483f

memory/4016-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2196-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2196-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2196-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2196-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2196-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2196-21-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 cf06e69b718d684709b6fe989057e676
SHA1 cdf02a0352856a0acb59232d1949c90123f93f6c
SHA256 1ba138579e18d200996577aa63ac96697b8f058ea38ea065ddaea6a6e8cddd93
SHA512 befd7da781058bf2303463edfc003414e66dc36b2fd566de7f1f4f6c7a3a09665f3ddf6d686ea719389cc17bbc56d685039a6cac7280e1cc4ac34cf375535f26

memory/2196-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1996-28-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4344-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4344-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4344-31-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 486d28577e912a04043e102ac0d307b1
SHA1 653184cbc62638182225626b5e736607fb9a58e8
SHA256 bf62b4d155a7c33ba56f97f247703fb9743ada311fae545c83cd552c0200a4a0
SHA512 df0d698539ea7ae9831d7a17a7acaecaf1bf60ec66c507f0410d0a985ce8fc43b6487c23b3556484a294415a7afa2701bfc2762d262d3ec7425774f2c2d4b866

memory/1652-39-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2864-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-52-0x0000000000400000-0x0000000000429000-memory.dmp