Malware Analysis Report

2024-09-11 08:31

Sample ID 240614-m4tx1axgjf
Target ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
SHA256 1d8643d030cf4fdbb88fb697e998dfdaac4387cb824607b4d6ecac40889840e0
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d8643d030cf4fdbb88fb697e998dfdaac4387cb824607b4d6ecac40889840e0

Threat Level: Known bad

The file ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 11:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 11:01

Reported

2024-06-14 11:04

Platform

win7-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1208 set thread context of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 2944 set thread context of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 set thread context of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1396 set thread context of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1208 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 2016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2944 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1624 wrote to memory of 1396 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1396 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1396 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1396 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1396 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1208-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2016-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2016-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2016-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2016-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1208-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2016-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e648691a5458511b1a14915efce76c7b
SHA1 82f2c8f576aa50db5e8cd35ad03c64ad943e8d84
SHA256 54a366b0628e19974bb017fb05ca80409e83b0013de39745449d5ab0e300a9fa
SHA512 faf6530b780c22ecf0082b011a5a68de148086c4481b233eda9f6f21c110860231472fa4f1f46d21eb0980c9bffb235a50a6977680a095e54a459b213be186b9

memory/2944-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2944-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2408-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 61ae9980f233f9468d092a8e6d404971
SHA1 56858ca44d802afc5123fd61c17c219ef5df75f5
SHA256 e9529c60e9207f838186214ca95711dd2d967b2da88abed413175eb27db58591
SHA512 209e2a41b740737a614f4e738b58a2795b0227502ed4d9ec7571df543ac9aef9e2a1feb1e1c1e24d0e5ab3941f139418ec4680964b00c76c1cd0704f2ce8dd6f

memory/2408-47-0x0000000000310000-0x0000000000333000-memory.dmp

memory/2408-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/868-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/868-65-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a480382f10a5f7917b7ae1e948a9deeb
SHA1 c04f0e41c4e53d41d06a3715cfdfb3629a8180f5
SHA256 6a6a589216e57d143e38ada740fea4db61466c6396085f9d0ae3da59a5202c43
SHA512 75deb9c8510b13d5689de7e346a26a561be2dbb757cae987781c68bb66e74e7719bd59968bb9131e493b6154e9527d4761f1531276aa1f51fee036e149c52926

memory/1624-72-0x00000000001C0000-0x00000000001E3000-memory.dmp

memory/1396-86-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2888-89-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2888-92-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 11:01

Reported

2024-06-14 11:04

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1008 set thread context of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 932 set thread context of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4752 set thread context of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2316 set thread context of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1008 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1008 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1008 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1008 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 1008 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe
PID 2376 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2376 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2376 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3936 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3936 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3936 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2344 wrote to memory of 2316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2344 wrote to memory of 2316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2344 wrote to memory of 2316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ba1c8551d79c87d6a4ee2e8b65e1ecc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1008 -ip 1008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 932 -ip 932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4752 -ip 4752

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 276

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2316 -ip 2316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1008-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2376-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2376-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2376-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2376-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e648691a5458511b1a14915efce76c7b
SHA1 82f2c8f576aa50db5e8cd35ad03c64ad943e8d84
SHA256 54a366b0628e19974bb017fb05ca80409e83b0013de39745449d5ab0e300a9fa
SHA512 faf6530b780c22ecf0082b011a5a68de148086c4481b233eda9f6f21c110860231472fa4f1f46d21eb0980c9bffb235a50a6977680a095e54a459b213be186b9

memory/932-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3936-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3936-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1008-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3936-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3936-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3936-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3936-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3936-30-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 516ab27a221f9fc46ff3634be04deb16
SHA1 af27ed3f060d16ba17225a8696bf59a952ea1002
SHA256 db15d25d64bbe7fb8ca857780a3f54d579c71506bea46eb71e80d4e9c1aafb38
SHA512 6b70e79ef4a095be04f3e166dae8d0107a61cbb2a3fbf431977e3debc22f2208dbde52c71dadc4e4741ade988becea7026bfd3c8c5013bce4a4a13ef9a2ac952

memory/4752-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2344-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2344-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2344-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2316-44-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c4f0e9fc99cb807353ee6fa557992f5b
SHA1 7f37afa5245a684be4a78bf503fd539a285a2112
SHA256 53de3242c8c5ef6cc6d7c55f5c2925cfac7714cfcb03030ae1b79b0e1134e4b2
SHA512 132f68d13690dde30bf9bfdeb0b21bd753e2c7b992d7e4f8ccda739570da34d581d60fdbb4f18284db431403b8ba06cbcb4e1338a95f725423d7fc0a9e18dc0f

memory/1712-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1712-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4752-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1712-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1712-57-0x0000000000400000-0x0000000000429000-memory.dmp