Malware Analysis Report

2024-09-11 08:32

Sample ID 240613-md9wjavbrc
Target 73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
SHA256 9bf6320e73914a8f94016138f5dae41c99aa2c02936fb74c25eb84e7a09eb775
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9bf6320e73914a8f94016138f5dae41c99aa2c02936fb74c25eb84e7a09eb775

Threat Level: Known bad

The file 73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 10:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 10:22

Reported

2024-06-13 10:24

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2232 set thread context of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2944 set thread context of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2928 set thread context of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2116 set thread context of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 2232 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 1604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2724 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2724 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1160 wrote to memory of 2116 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1160 wrote to memory of 2116 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1160 wrote to memory of 2116 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1160 wrote to memory of 2116 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2116 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/2232-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-1-0x00000000003C0000-0x00000000003E3000-memory.dmp

memory/1604-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1604-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1604-12-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1604-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1604-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1604-15-0x00000000002C0000-0x00000000002E3000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e735a1747ea6f53cf1156e97ed862f6d
SHA1 b0a5e4d0bfce8d4fe8b7a6a02e4e0f94039cdbab
SHA256 4eec1b6a89e10c34715d1f59d321a606966007e72efca82fe713560bcd6cee02
SHA512 8b19001eeb7a9ef04ed921d5c5b7a3e250cd44548fc453f532b362bc87d85bdaf4c030b4b7711eab4beb7d4450e82c394655b63f5f88d46eb7f21456b548c10f

memory/2944-23-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2944-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2724-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2724-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2724-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2724-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 dff5a9a011b3a2950fdc59a4c72c9387
SHA1 78086bf1b07f184a420f608c9ddf0624ed12ea4c
SHA256 0b45877089b5fda9d2ba36807b5572315197815911a1a6fa599e7afa6bece685
SHA512 93f9bd49bdb9201642c5f15b8119b48fb1ebe42a723da1e46c3c9b6177f01e46dcb0e591eb9988c85ead7ce92094c3ebe94330f61d4ae0f341d3978fde7477e6

memory/2724-47-0x0000000000370000-0x0000000000393000-memory.dmp

memory/2724-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2928-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2928-65-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 25f46ace29a7191e39ca4a62392cb5fd
SHA1 b04b944efc4b5edc8d77d01c58132aee607607f0
SHA256 aa173586a1dcc1d85d7b83bf9c11d65f737a9c66a015447a120c054809318726
SHA512 68ea73706f2cacd8c1e350f4079affe8f0ed38171444285bea0586695a0550bd76b4fde3a558b45dfd084476fd65f346070066760363a972967a3e21c8b26538

memory/1160-71-0x0000000000230000-0x0000000000253000-memory.dmp

memory/1160-76-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2116-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2116-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2204-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2204-93-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2204-95-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 10:22

Reported

2024-06-13 10:24

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4880 set thread context of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4352 set thread context of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3432 set thread context of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3744 set thread context of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4880 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4880 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4880 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4880 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe
PID 4532 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4532 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4532 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4352 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4352 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4352 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4352 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4352 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3428 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3428 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3428 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3432 wrote to memory of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3432 wrote to memory of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3432 wrote to memory of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3432 wrote to memory of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3432 wrote to memory of 4024 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4024 wrote to memory of 3744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4024 wrote to memory of 3744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4024 wrote to memory of 3744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3744 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3744 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3744 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3744 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3744 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\73de7afafe9c920af67763e05e6d2a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4352 -ip 4352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3432 -ip 3432

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3744 -ip 3744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 268

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/4880-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4532-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4532-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4532-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4532-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e735a1747ea6f53cf1156e97ed862f6d
SHA1 b0a5e4d0bfce8d4fe8b7a6a02e4e0f94039cdbab
SHA256 4eec1b6a89e10c34715d1f59d321a606966007e72efca82fe713560bcd6cee02
SHA512 8b19001eeb7a9ef04ed921d5c5b7a3e250cd44548fc453f532b362bc87d85bdaf4c030b4b7711eab4beb7d4450e82c394655b63f5f88d46eb7f21456b548c10f

memory/4352-10-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3428-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3428-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4880-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3428-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3428-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3428-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3428-24-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 d59c4cd918b86e5e0de10c4fff5a574f
SHA1 c5f0bcc338fdd9569495da78c23ac5d70476be15
SHA256 30d2b75808720f92b3f0b6d5d2c7dc9631f61a397eac6053c291d64be6d3c5d5
SHA512 ec37d6bebfe6745c263c3185230fd946856dc6361359761d4c336bc849551712ee0b2f0cc090dbbbb814575ea8df8b40dcb5fd292f2998bcb779a963e63e5f26

memory/3428-27-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3432-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4024-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4024-34-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fdeb952b10be9b878574ef3d47e333b1
SHA1 e1c5c93f0dc7bf926e4cba221c0eaf90eda21935
SHA256 46ad804e65c95f4cb7c80ef2f3e7d849609e2a765e3d49fd60e8f4235c16a22e
SHA512 02ebd16c7a8c82983282634a13786d47381864d76a04cb6cdeabde5d5b711625a5d8d0d4a1fb593e726174956428cc39873b88a48fb14890fdc383809321a967

memory/3744-40-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4024-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2296-55-0x0000000000400000-0x0000000000429000-memory.dmp