Malware Analysis Report

2024-09-11 08:32

Sample ID 240612-ls824stflk
Target 30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
SHA256 9ef4cb189719cf3a778b3b26f415bfb5d7348e7e81163f52eea74803e23860fc
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9ef4cb189719cf3a778b3b26f415bfb5d7348e7e81163f52eea74803e23860fc

Threat Level: Known bad

The file 30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 09:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 09:48

Reported

2024-06-12 09:51

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2148 set thread context of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2712 set thread context of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2156 set thread context of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2288 set thread context of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2148 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2396 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2396 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2396 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2396 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2672 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2156 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1632 wrote to memory of 2288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1632 wrote to memory of 2288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1632 wrote to memory of 2288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1632 wrote to memory of 2288 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2288 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/2148-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2396-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2396-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2148-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2396-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2396-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5ff3afb947494c7b75e046e44e671214
SHA1 c4d2629d045a9a1f1d640be0525730e6b9f375f6
SHA256 600726cc74ba53c5dd7f20c2bf5296d6605cc51098f830d17566f467b648fda8
SHA512 003088a99c5338cdf0fdf6bb2302ff2d3f1b7e3f0df4f318da2138a2b9bdfc6319bd8d03cddd40ca21dbff3e635e9f03775659035a56d2014711cc3f123e3845

memory/2712-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2712-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2672-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2672-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2672-41-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 a131379d5322dfe9975abd7fbe4f1876
SHA1 6cbf4549c8c3ec98a57f9eb1ee3794630e60bce8
SHA256 e0e54601a196f5d0a5b447d8c34f8ae4618106cd6b666039962b3c0e13c70e92
SHA512 e45f195a8518c013d061a4d73ae58daae28479cc9c61580fb5f9c18a1bc51b76c16cc7b4b647bf2f340820037a1db2e27083db1f45cca3f2c925cf442531d555

memory/2672-46-0x0000000000380000-0x00000000003A3000-memory.dmp

memory/2672-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2156-55-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2156-63-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 080446acc769e680f9d3d562ccc85071
SHA1 b72eb44d0cdaa336e93d5b397964959905204b98
SHA256 75e618316c0e0c20d3cc3bc11935b458da7275df78f3bcf109c699f8c2d9eb1a
SHA512 73c7bdab7b73ea3c3a828a68de6e861dc76abb300ecb648a0cbe606a081ce629827b2f56e1bd896d98f8f1cfe0326337a78fc99f4cf2063a924fb7b2d6e99076

memory/1632-70-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2288-78-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2288-85-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2508-88-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2508-90-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2508-92-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 09:48

Reported

2024-06-12 09:51

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2916 set thread context of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2656 set thread context of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4852 set thread context of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4508 set thread context of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2916 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2916 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2916 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 2916 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe
PID 4828 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4828 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4828 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1376 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1376 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1376 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4852 wrote to memory of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4852 wrote to memory of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4852 wrote to memory of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4852 wrote to memory of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4852 wrote to memory of 4804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4804 wrote to memory of 4508 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4804 wrote to memory of 4508 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4804 wrote to memory of 4508 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4508 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4508 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4508 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4508 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4508 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\30b093088b719b29c01cc6c858f94690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2916 -ip 2916

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2656 -ip 2656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4852 -ip 4852

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 udp

Files

memory/2916-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4828-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4828-2-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5ff3afb947494c7b75e046e44e671214
SHA1 c4d2629d045a9a1f1d640be0525730e6b9f375f6
SHA256 600726cc74ba53c5dd7f20c2bf5296d6605cc51098f830d17566f467b648fda8
SHA512 003088a99c5338cdf0fdf6bb2302ff2d3f1b7e3f0df4f318da2138a2b9bdfc6319bd8d03cddd40ca21dbff3e635e9f03775659035a56d2014711cc3f123e3845

memory/4828-7-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2656-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1376-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1376-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1376-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1376-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1376-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1376-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1376-33-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 2e942661c466e3e4cded848caf4acf1b
SHA1 fba7a86b72e5ba3101afa75ef509306f9f5435cc
SHA256 6ba4421dd6741b9c9201d8869578031ea49b28070e4d79dba1ef8b72f3e4570d
SHA512 041fd33b38ac2371600ee5554827917e2086e974924b9aa9895ffa7e8c5245715f5418d7cbed35685d35ad98b0d8ce3399453d966cee8dfe2fd383418ea1573c

memory/4852-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4804-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4804-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4508-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4804-43-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 dbe87eac449ac678679bc0d54aedd5fb
SHA1 39201cd78c0f244712c1e5529909a2a2b260a3cf
SHA256 d0d044c86c14e23c9a334f3cef793b70afa3de0a39eb5a707d774562df79c84a
SHA512 d2003f110a0a8c851e1a0b9d8f5d93dd071959f7d76553354014f8d383e424d2a169d158dcc01652b4e4455f369bd15a78e7649ecde2c61ed4ab9a907df25c4a

memory/3964-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3964-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4852-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4508-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3964-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3964-56-0x0000000000400000-0x0000000000429000-memory.dmp