Malware Analysis Report

2024-09-11 08:31

Sample ID 240614-hx5cyazbna
Target ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
SHA256 b4d991a4267bd8949fa9d51caf8e88034bf31a92b0cbf9302960fc8e74906fac
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b4d991a4267bd8949fa9d51caf8e88034bf31a92b0cbf9302960fc8e74906fac

Threat Level: Known bad

The file ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 07:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 07:07

Reported

2024-06-14 07:10

Platform

win7-20240221-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1724 set thread context of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 2916 set thread context of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1680 set thread context of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1444 set thread context of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1724 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 2236 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2236 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2236 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2236 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2916 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2632 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2632 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2632 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2632 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1680 wrote to memory of 992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 992 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 992 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 992 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 992 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1724-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2236-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1724-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2236-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2236-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2236-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2236-10-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1b7cfd9b0578421e76afec4f6b40abba
SHA1 4bafd68181ff79c44cce093136b85c2ff702f350
SHA256 f1a4f133a76c7adf5fcf845b4abf9ff58b5834fdb0e5fcb06e43c25cd1beb936
SHA512 759db9f3737ae77b92daeef0d10fbb5c1e4f7eb93d3cc4f85c25797fcf41bc30c93e6b34dd36159a0672db28673ae82a2c5310b8cb4f327bf7847af645eb4425

memory/2236-14-0x0000000000260000-0x0000000000284000-memory.dmp

memory/2916-21-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2916-30-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2632-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2632-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2632-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 faf966c187c1082fa73cf4149d765ecf
SHA1 393a8edb9377cd00549e04de4e8f523dbeb210be
SHA256 64f37dd0ffb61000c68071bcce2a5bdbd5c4a2f2639d1b79c88f90fc80fc5cb4
SHA512 b30168934d8eaebf25ac2d8b25105d388d3a9387a3e2900b9688ebdb4bc549148dfad5ec06eb09412bbffddf4641cd04d09cf3b149dbeb9a13369677a0949fcb

memory/2632-45-0x0000000000320000-0x0000000000344000-memory.dmp

memory/2632-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1680-55-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1680-63-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 215d4dc09a1205e8181002359b5f8b30
SHA1 cabe098734f2b518910f9d66c5aeb1cd5e375831
SHA256 b85dc6d0c46c17a38650f6f5b954153ce24998d7ea0f264af1e6af4cc43fb514
SHA512 ddc9dacc0c9ef95d5ad6f5b206d1fae25058a70534e12edcba870c0bcca66659aea69fc392455a4f9525e3df3249c12cf64882fc11f06e8a7cb57357eda44b50

memory/1444-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1444-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2532-85-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2532-88-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 07:07

Reported

2024-06-14 07:10

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1360 set thread context of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 4216 set thread context of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 set thread context of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3412 set thread context of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1360 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1360 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1360 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1360 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 1360 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe
PID 5088 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5088 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5088 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4220 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4220 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4220 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1408 wrote to memory of 3412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1408 wrote to memory of 3412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1408 wrote to memory of 3412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3412 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3412 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3412 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3412 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3412 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ab9ad90dd866b7ac9e8b10cd31cf4ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1360 -ip 1360

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1996 -ip 1996

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3412 -ip 3412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 268

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/1360-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5088-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5088-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5088-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5088-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1b7cfd9b0578421e76afec4f6b40abba
SHA1 4bafd68181ff79c44cce093136b85c2ff702f350
SHA256 f1a4f133a76c7adf5fcf845b4abf9ff58b5834fdb0e5fcb06e43c25cd1beb936
SHA512 759db9f3737ae77b92daeef0d10fbb5c1e4f7eb93d3cc4f85c25797fcf41bc30c93e6b34dd36159a0672db28673ae82a2c5310b8cb4f327bf7847af645eb4425

memory/4216-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4220-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4220-25-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 b3542fa45a32f37f61bc78050da67d66
SHA1 e30b86f0740cea31ce4b639c5d3ca8c962ab740c
SHA256 73f3b6ad8df080c495d980086ae7c77eebb440b94ae1c2797e1b4ba02dca489f
SHA512 0962c7aee9edef4ab476d5997539af748330d2936ca09a37af6bd2171b7adba64c9796712202287a094bb7d11ac47bc2bfef71bde44e71bbd7297ada4ab312bb

memory/1996-28-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1408-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1408-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1408-35-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8966d4dc63d6d6bcd6a7bea1ae4c26cf
SHA1 7ba03f37a1c32c5793d1fba9d8e34a7b4234be1f
SHA256 c26bc9a8eb3e8f4ec2eec00697d4f9f13a4bcca9aa0de551598da7171950802a
SHA512 64d6ebd38d8320fe9195a36776fbfc4a28fc3a3213a5400f7a0bd850f320a7104a7c0f56c387514aa403a3f8ff02a9fcb5cb07d210f5160353677f519adc4da6

memory/3412-40-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3056-44-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3056-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1996-46-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3056-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3056-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3056-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3056-53-0x0000000000400000-0x0000000000429000-memory.dmp