Malware Analysis Report

2024-09-11 08:40

Sample ID 240614-b3yzsazgmf
Target 97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
SHA256 ed013af26b80c099dacfef8c8ad885e86733ba51221b95112aef922a93e67578
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed013af26b80c099dacfef8c8ad885e86733ba51221b95112aef922a93e67578

Threat Level: Known bad

The file 97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:40

Reported

2024-06-14 01:43

Platform

win7-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2516 set thread context of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 3028 set thread context of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2740 set thread context of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1092 set thread context of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2516 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2468 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2468 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3028 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2688 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2740 wrote to memory of 1084 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1084 wrote to memory of 1092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1084 wrote to memory of 1092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1084 wrote to memory of 1092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1084 wrote to memory of 1092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2516-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2516-1-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2468-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2516-7-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2468-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2468-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2056c2efede8029cb8826c7405872f91
SHA1 b8ddcb0a82d91da4cdcd8d019d1632534c37688a
SHA256 c9c586cb9a4b754eb68f016d117f899037785fe7a99f24e52dda0e544f0b3ea5
SHA512 8d9d5d8514bf16cf058b4442a5474a5acff8e7502fb57552e7d1475c6c0272153836c815ee68d676f4afed9ca52afa0e7f4733470881c41f48f3c5a977b893d6

memory/2468-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3028-21-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3028-24-0x0000000000330000-0x0000000000354000-memory.dmp

memory/3028-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2688-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2688-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2688-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 8c703fdf81feea6bc9ae0978eaf591df
SHA1 10d3ac4c9c29a130cf39119ec44c9f759340688a
SHA256 4fc47387214e1a89df72d4fd652eb4b122329887ef522a40b4c390f6e01c2de2
SHA512 417e8f834efeae891845b931b7e4f8b354050bd6a427028e802eb1369fd1885f48cbf8ee6e193d0918ba50d39a25ee80353f794526586c3b48451f8ce3aabcdc

memory/2688-47-0x0000000000380000-0x00000000003A4000-memory.dmp

memory/2688-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2740-57-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2740-64-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 68ea8c674df4262ed4504fe33c28cd1a
SHA1 fd9f11b1ec98470b655742e0a2141d0ad68d2263
SHA256 01ddd38d2b96740c42590d2a664667f47b9da8707332ec1436c55749a6f04f74
SHA512 32acba2f6daa639e7e9c2f3794f6d8011577c27908ccf6d5f6f5f51e1cafc4cad82a49680aa2c7bd922e502aa0d7a727256b0dd964baef3dc1f66b82a99e2132

memory/1084-70-0x0000000000230000-0x0000000000254000-memory.dmp

memory/1092-85-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1692-87-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-90-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:40

Reported

2024-06-14 01:43

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4708 set thread context of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 2404 set thread context of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4432 set thread context of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1392 set thread context of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4708 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 4708 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 4708 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 4708 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 4708 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe
PID 900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2404 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2404 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2404 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2404 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2404 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1236 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1236 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4432 wrote to memory of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4432 wrote to memory of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4432 wrote to memory of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4432 wrote to memory of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4432 wrote to memory of 844 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 844 wrote to memory of 1392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 844 wrote to memory of 1392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 844 wrote to memory of 1392 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1392 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1392 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1392 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1392 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1392 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\97ed7822263f25827222d01a03248a90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 276

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2404 -ip 2404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 252

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4432 -ip 4432

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 264

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/4708-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/900-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/900-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/900-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/900-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2056c2efede8029cb8826c7405872f91
SHA1 b8ddcb0a82d91da4cdcd8d019d1632534c37688a
SHA256 c9c586cb9a4b754eb68f016d117f899037785fe7a99f24e52dda0e544f0b3ea5
SHA512 8d9d5d8514bf16cf058b4442a5474a5acff8e7502fb57552e7d1475c6c0272153836c815ee68d676f4afed9ca52afa0e7f4733470881c41f48f3c5a977b893d6

memory/2404-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1236-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1236-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4708-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1236-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1236-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1236-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1236-22-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 deb0f9eea3562ea5040e5877d3a533b9
SHA1 b89ac018a52056cbe7d7edf52a6062e151f98a5f
SHA256 ceacaab236767af18b7da5f14f39fb2cd59ba8215238eed5e1c5103c028e1b69
SHA512 1a926952a345cf51d5679497232d079dc085763916888cda321a020b96e577863b9c87e88a9236d201bfc17807c89a662a13c533eabc4fac2d9a6c8b9cd640a6

memory/1236-28-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4432-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/844-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/844-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/844-36-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 74d5de9c888a168074f47be0e930e509
SHA1 72d6492f483b84f4604e743c3926cde5e412411c
SHA256 857483663cae3090645ba1a19228f8db937db561cc661df8a7ee61dd85895a60
SHA512 af8b63752d26a5b35250efa357b34f57380fa6992a014a80c50166558f3d99516087c2b6939cb2c5ae2bc694691580ca82364ef5230650b86b43e13fc645e03b

memory/1392-41-0x0000000000400000-0x0000000000424000-memory.dmp

memory/436-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/436-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4432-47-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1392-48-0x0000000000400000-0x0000000000424000-memory.dmp

memory/436-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/436-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/436-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/436-55-0x0000000000400000-0x0000000000429000-memory.dmp