Malware Analysis Report

2024-09-11 08:30

Sample ID 240614-xrvzmswfmm
Target 16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb
SHA256 16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb

Threat Level: Known bad

The file 16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Detects executables built or packed with MPress PE compressor

Neconyd

Detects executables built or packed with MPress PE compressor

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 19:05

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 19:05

Reported

2024-06-14 19:08

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2236 set thread context of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 100 set thread context of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2276 set thread context of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1912 set thread context of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2236 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2236 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2236 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2236 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2788 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2788 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2788 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 100 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 100 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 100 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 100 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 100 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4764 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4764 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4764 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2276 wrote to memory of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2276 wrote to memory of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2276 wrote to memory of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2276 wrote to memory of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2276 wrote to memory of 1104 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1104 wrote to memory of 1912 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1104 wrote to memory of 1912 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1104 wrote to memory of 1912 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

"C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe"

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2236 -ip 2236

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 100 -ip 100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 276

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2276 -ip 2276

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1912 -ip 1912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/2236-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2788-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2788-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2788-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2788-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/100-11-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8bec1a44e865fda803c27276d5c322ac
SHA1 a58156684b74839212fa61c39fb490ee2d42208f
SHA256 7ec889decb1044df3010f48782512cc2601b8331aa049ebece007ce480fc85ab
SHA512 f5deda2723c7c4f6ef04eb0ab5e5b510eb80e49c7b8e95000d3438bebbb4766a2a76791741edabf583318c63ee4f89ea30ced1af888a8bef05734774b790f7c1

memory/4764-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2236-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4764-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4764-22-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 91d9be42179cacc98e12a44ee27972d9
SHA1 50023ebb9a27357779d4e421059099cf9db59240
SHA256 1b5f6aef6ad761d2be6cb6db6a7e1435123a6d280e61189b883d31fd2b3ab8de
SHA512 315cf0ee87d9df100faffc36f042ea76e9094b022b706303a7ae0de7a8ddd901ad679b7a4d856874ddd19a2a2fe0c21898998011407e1b4bd1a12776135fdd4a

memory/4764-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2276-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1104-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1104-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1912-39-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1104-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 69f65ffc8d9c544c8a0bebedb09ea078
SHA1 6fa0f1409990f72b86e93b46859ed0c05ff01088
SHA256 48eab193fff48923f1469c231f3cc64b6084bd994b1f7315a8aff0581eacbb26
SHA512 3beaf1bfbf8c978edc632ab8c653f4878dae391d655c48aa306f11688d14f02118a1503a5125a183132f7ab273eb20a78e8ea3ed85d0d03a74d01822825fb314

memory/1224-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1224-44-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1224-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1224-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1224-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1224-52-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 19:05

Reported

2024-06-14 19:08

Platform

win7-20240221-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2512 set thread context of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 1052 set thread context of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1956 set thread context of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1624 set thread context of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2512 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe
PID 2768 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2768 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2768 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2768 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3068 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3068 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3068 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3068 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1956 wrote to memory of 2660 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2660 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2660 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2660 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2660 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

"C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe"

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

C:\Users\Admin\AppData\Local\Temp\16aa64e928dcd948cd509164b44b039fb708ca5367b5ac3dab1490d834c9bcbb.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2768-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2768-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2768-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2512-7-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2768-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2768-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2512-1-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2512-0-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8bec1a44e865fda803c27276d5c322ac
SHA1 a58156684b74839212fa61c39fb490ee2d42208f
SHA256 7ec889decb1044df3010f48782512cc2601b8331aa049ebece007ce480fc85ab
SHA512 f5deda2723c7c4f6ef04eb0ab5e5b510eb80e49c7b8e95000d3438bebbb4766a2a76791741edabf583318c63ee4f89ea30ced1af888a8bef05734774b790f7c1

memory/1052-21-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1052-24-0x00000000003C0000-0x00000000003E4000-memory.dmp

memory/3068-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-30-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3068-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3068-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3068-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 201776e44bbda370e981558e688e6393
SHA1 8818f975aa254d33d36b70134c05496c9001fb6e
SHA256 4c023adef119e00768824583b766fdf8e14c727e4cbe00f13ec171593eaab177
SHA512 cba19dc6c960349e90051cdde2fd1b8d1838f0da683c52f56deb8c3385a65c0517204b92e31702cc73bb8b1c0cd0078215ba0c8c4d816e1412e94c2ad8319a9d

memory/3068-47-0x0000000000360000-0x0000000000384000-memory.dmp

memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1956-64-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 01366431b8bab476ca6fad371b5ffc19
SHA1 4200456f0317da05f81b73ebd30053e8f67bb8d0
SHA256 d8e1041b4fbe4d029bb2b15678c30a3e3b68420df822e26b5cd46041db185d7f
SHA512 1ecd962de3f7505982a9fdafd79fa0a2e9c5fe0c2ddcd4172b641747316991ca41e51dcb91daa85837ce4ec5ba683f32d23634e567ab394fd4ee143e9efd663f

memory/1624-77-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1624-84-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1824-86-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1824-89-0x0000000000400000-0x0000000000429000-memory.dmp