Malware Analysis Report

2024-09-11 08:31

Sample ID 240613-bsztbsygkf
Target 537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
SHA256 a924b5f0563ac4bef9d6d060b11987c98605ededf44036211fe9cd14a35d843e
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a924b5f0563ac4bef9d6d060b11987c98605ededf44036211fe9cd14a35d843e

Threat Level: Known bad

The file 537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 01:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 01:25

Reported

2024-06-13 01:27

Platform

win7-20240611-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1252 set thread context of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1420 set thread context of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1060 set thread context of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 812 set thread context of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1252 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 1284 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1284 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1284 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1284 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1420 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2656 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2656 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1060 wrote to memory of 1112 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1112 wrote to memory of 812 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1112 wrote to memory of 812 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1112 wrote to memory of 812 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1112 wrote to memory of 812 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 812 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1252-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1284-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1252-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1284-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1284-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1284-1-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a4d05c83bd98fd1f2b2a1db90009ce39
SHA1 713d09696f8e4e4cf6cc4c056f42392693ce1f9e
SHA256 cc387f323492886f6996b22293e865a1879cd203486848ee17aa65d171f415dd
SHA512 3a4583af9b2dbbd4ffb194add402e30def4032037f0871927079c163cac592b3a3d59e73dcb191ac6c4f5ec6aa98f6680c4331438965a6e7e980f83b1c439fe3

memory/1284-13-0x00000000002C0000-0x00000000002E3000-memory.dmp

memory/1284-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1420-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2656-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2656-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2656-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2656-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 ccd4f09bc41dbc8ebbb28e03e9e01e35
SHA1 a9f6e8877786c468429f5a8a0d2bbf5b64d39321
SHA256 b52bd0f2891243e71425e64d9b7193b0814369f365c49f0e1638bab63f809c7e
SHA512 89bcbdb805949832dc5dffb8867e3bc11791b8d1842cdc820d66f2d48ef6078073930ab853f4447fdae64af8513a0dacddb53b5e98dee92bebc30587c401cac2

memory/2656-46-0x0000000000370000-0x0000000000393000-memory.dmp

memory/2656-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1060-56-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1060-64-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 19a1305f01347ec681efc45e13d151bf
SHA1 e9d2e8a7c25bc8bffb526c1d1bda8a18f44b2884
SHA256 19c6fead052e7205aa2c77194ba37011cea0700d73f7765e251960f33e21003f
SHA512 d7272cf10ec77c96aeb5e2e07a078c3e322ccc4047dc71a7d7f588b340d5da1445abf2a6ac88be20e442b3089231e62c3ad80d03e00fec075c7ee94a0a0502df

memory/1112-71-0x0000000000430000-0x0000000000453000-memory.dmp

memory/812-79-0x0000000000400000-0x0000000000423000-memory.dmp

memory/812-86-0x0000000000400000-0x0000000000423000-memory.dmp

memory/940-89-0x0000000000400000-0x0000000000429000-memory.dmp

memory/940-92-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 01:25

Reported

2024-06-13 01:27

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3644 set thread context of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 4452 set thread context of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 set thread context of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4668 set thread context of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3644 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 3644 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 3644 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 3644 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 3644 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe
PID 2916 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2588 wrote to memory of 4668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2588 wrote to memory of 4668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2588 wrote to memory of 4668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4668 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4668 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4668 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4668 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4668 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\537635333366fb6c9942dae23e506f90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3644 -ip 3644

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 300

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2724 -ip 2724

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4668 -ip 4668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

memory/3644-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2916-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2916-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a4d05c83bd98fd1f2b2a1db90009ce39
SHA1 713d09696f8e4e4cf6cc4c056f42392693ce1f9e
SHA256 cc387f323492886f6996b22293e865a1879cd203486848ee17aa65d171f415dd
SHA512 3a4583af9b2dbbd4ffb194add402e30def4032037f0871927079c163cac592b3a3d59e73dcb191ac6c4f5ec6aa98f6680c4331438965a6e7e980f83b1c439fe3

memory/2916-7-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4452-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4460-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4460-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3644-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4460-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4460-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4460-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4460-26-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 8b45bd3a87505ccad7804572f4ca3788
SHA1 cd75d13cd65a4d1e6791b378969e7e3be75f4406
SHA256 ef04ea8b1aa24b75e3c5336a495feec2413648c150aa5b9fb83eed9c736baff3
SHA512 4f48c420e9338f0dff221c31dda40ad73535c038cc0a2ad57c7a1090db017e1e5db961abe0394b381196bcb3dd0ffe2e9a78ea7dbf3c14bc83a8582cd56b01d8

memory/4460-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2724-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2588-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2588-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 03b901432e5e12bc87296aeb64887624
SHA1 4a3d06e3292d4a1ab6802806e86a7b2c15ceff2a
SHA256 9c42bae60de25cecdd10f124e4efa6b868597542e5732e6d7cd13493578754b9
SHA512 b24a88a654ee778a0ce3c854113bf24a35ad0178d2b4342d7d7243ed3103d952ff49cb7dfa22da8be7ea315d9eaaf8f7dff5de0da4e39d76c82062b9d2090965

memory/4668-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4880-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4880-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4880-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4880-56-0x0000000000400000-0x0000000000429000-memory.dmp