Malware Analysis Report

2024-09-11 08:30

Sample ID 240615-3vrpaazeqh
Target 87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd
SHA256 87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd

Threat Level: Known bad

The file 87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Detects executables built or packed with MPress PE compressor

Detects executables built or packed with MPress PE compressor

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 23:50

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 23:50

Reported

2024-06-15 23:52

Platform

win7-20240611-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2028 set thread context of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2804 set thread context of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1552 set thread context of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2752 set thread context of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 1732 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1732 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1732 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1732 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2804 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3052 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3052 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3052 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3052 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1552 wrote to memory of 1360 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1360 wrote to memory of 2752 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1360 wrote to memory of 2752 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1360 wrote to memory of 2752 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1360 wrote to memory of 2752 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2752 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

"C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe"

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2028-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1732-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2028-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1732-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1732-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1732-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1732-9-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5084bf0c05abd9e068fc1db7f105cbc5
SHA1 4a285f680b35efc1135237b9f9bf152ded5fd66f
SHA256 fc81578564487d1dc6352fe00e007cdcd48311320a2283c5a25398f56fad4d4e
SHA512 24312538e30fff571d376cb7c93adf8940db81909d6b70cb0c61e38c95e1ad86fd3fcd0e03c87a9932d5c0acaf4c227284902c7ed99bb9f780f156c4a57f52c0

memory/2804-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2804-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2804-33-0x0000000000230000-0x0000000000253000-memory.dmp

memory/3052-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3052-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3052-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 c9135c58ad309cffcd351233a0496cd3
SHA1 84da7f78726743558de4740f27c8676b7afb881a
SHA256 d33e9df832454688b7907dcb8394f4cc2c8ff1e19f045e79aa51fe2eb2205977
SHA512 28017b5c9d2048234159ebb36229d92d5133094f5c2bc7dc3c103ab42619fd3e1ab15033434ebe409e0e5015182c8e79bb1c6eba37122fdb5214f47edd3fd046

memory/3052-47-0x0000000000310000-0x0000000000333000-memory.dmp

memory/3052-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1552-65-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c34e78d96aaae59d72c7f80437b2fee8
SHA1 9e1aa47fbda8e48768d8627270a23217af7fb2c5
SHA256 7c2be7cffda33de1ea7ae25bb349fee00939c1728caad5b69e5847916fc7a468
SHA512 7b078c557f7bcdce1368f0a2a69bfb625a694dddee7f2239a34275af0e8dd32559ab31dd541e3cd1675e2d61a292d6068b4caec0aa4ecef10207774d2a9b9d79

memory/1360-72-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2752-80-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2752-88-0x0000000000400000-0x0000000000423000-memory.dmp

memory/672-90-0x0000000000400000-0x0000000000429000-memory.dmp

memory/672-93-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 23:50

Reported

2024-06-15 23:52

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 944 set thread context of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 2272 set thread context of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1604 set thread context of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4872 set thread context of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 944 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 944 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 944 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 944 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe
PID 3636 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3636 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3636 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2272 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2272 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2272 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2272 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2272 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3808 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3808 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3808 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3464 wrote to memory of 4872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3464 wrote to memory of 4872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3464 wrote to memory of 4872 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4872 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4872 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4872 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4872 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4872 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

"C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe"

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

C:\Users\Admin\AppData\Local\Temp\87daa84a9ed5e4d399f02d4a627b123155a07db42a8f4c4bbff5e8b58ba9e3dd.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 944 -ip 944

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2272 -ip 2272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 300

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1604 -ip 1604

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/944-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3636-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3636-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3636-1-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 5084bf0c05abd9e068fc1db7f105cbc5
SHA1 4a285f680b35efc1135237b9f9bf152ded5fd66f
SHA256 fc81578564487d1dc6352fe00e007cdcd48311320a2283c5a25398f56fad4d4e
SHA512 24312538e30fff571d376cb7c93adf8940db81909d6b70cb0c61e38c95e1ad86fd3fcd0e03c87a9932d5c0acaf4c227284902c7ed99bb9f780f156c4a57f52c0

memory/2272-10-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3636-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-13-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3808-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 004b1b4d24443fcde9d4e2c02c4e0f0d
SHA1 dab22087d3ec533a91bf675aa01fa9e586f392ca
SHA256 f8f864f416383311bafff8ca8d7ba8f4e546b62f85adeb15a0aaec65427b74c9
SHA512 4e9c39141eea4a5fa6c66c55f0c3555f851fedc90b51b400759bac294dc3503cce109332adc35033f6ce0b212c6112a57cb3da3aeee147c348cd5f00fe1c56e6

memory/1604-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3464-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3464-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3464-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4872-42-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2ed6b7494d7d29c35e6710a3bed827d9
SHA1 bac7ea4ef33d809815aa056ddf15268050576725
SHA256 0bfd3f505df987d8e6472fed1dc5c510bed6795735a25dae7964176a127e9158
SHA512 8a38535d29e42f4d4f5ce772e9334bc4e0e60b831081c05ad32cd6e7d7e4296cee0f6f0ec2aa57e1f2569d8ee76a4a40b47846cfc13b2f5148fb56e8dd44180e

memory/2480-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2480-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4872-50-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2480-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2480-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2480-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2480-57-0x0000000000400000-0x0000000000429000-memory.dmp