Malware Analysis Report

2024-09-11 08:30

Sample ID 240616-y1h7wazbrp
Target 01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
SHA256 7cb06ccf25dd5dbafa40d13ec81bdd6a42a3fbda130cf13edccb941996f450d1
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7cb06ccf25dd5dbafa40d13ec81bdd6a42a3fbda130cf13edccb941996f450d1

Threat Level: Known bad

The file 01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 20:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 20:15

Reported

2024-06-16 20:17

Platform

win7-20240221-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2204 set thread context of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2520 set thread context of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2680 set thread context of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2248 set thread context of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2204 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 2220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2680 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2756 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2756 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2756 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2756 wrote to memory of 2248 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2248 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2204-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2204-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2220-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2220-12-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 94e4b3bc588f247f68fb8a6baeb8b63a
SHA1 3116117aa285ca06963eb453e5758c55a4fe93c7
SHA256 d9a3d912a63d39b1fc04cb1969b8d70e666f9cc014209779012088a05fdd12dd
SHA512 6cde34d523262b0fb1525af2b6f257508ee72aad3d570b4685d5a2f4f465be29c9dedae2ab516ac5c9fd12165549bcea89ccc5b78369d066f0eaf8551a39e022

memory/2204-6-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2220-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2220-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2220-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2520-25-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/2520-24-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2624-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2624-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2624-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2624-46-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 bb1a653b5203b3491a1a2a0e8347feb1
SHA1 d302eb5fda8376dcfedfa404586b3d467b82616a
SHA256 f4471c11fd27f246849bd43604e381f28a3828dd66f22da293abb89acae4773b
SHA512 02e15d6cdbcca6f01c4f88613ce4ffcd053c4d9e2b3a6b5c14ba9409a24b8d23d3b2076469f276ee7df29b414f277ceba07f6301ee6ffbfb89ea3459b5b39d7e

memory/2624-49-0x00000000004A0000-0x00000000004C3000-memory.dmp

memory/2624-57-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2680-59-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2680-67-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7c8221d4a3e4661d4e4cc2b8324b6252
SHA1 50b89d954893f63a48297caa1f3d0756b66c6d2e
SHA256 997c0c4df493a655236d2537640f46f77de4d7d9af0ea7e7891278b6d07bce68
SHA512 37ec7422e3f5f498cdfa630fbe32fcaa88d5b07de0c090c588399d56e7515c12456b34f7eae08be0d3fd5779bf386e8e222ea11425b2e2c1c8f037b5fb235a33

memory/2756-74-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2756-82-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2248-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/864-92-0x0000000000400000-0x0000000000429000-memory.dmp

memory/864-95-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 20:15

Reported

2024-06-16 20:17

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4384 set thread context of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 4092 set thread context of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3632 set thread context of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2184 set thread context of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4384 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 4384 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 4384 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 4384 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 4384 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe
PID 3168 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3168 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3168 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4092 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4092 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4092 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4092 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4092 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1284 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1284 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1284 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3632 wrote to memory of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3632 wrote to memory of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3632 wrote to memory of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3632 wrote to memory of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3632 wrote to memory of 3820 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3820 wrote to memory of 2184 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3820 wrote to memory of 2184 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3820 wrote to memory of 2184 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2184 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\01e8da7f391c547589c55bfc5c04ab40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4384 -ip 4384

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4092 -ip 4092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 276

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3632 -ip 3632

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2184 -ip 2184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 23.53.113.159:80 tcp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/4384-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3168-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3168-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3168-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3168-7-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 94e4b3bc588f247f68fb8a6baeb8b63a
SHA1 3116117aa285ca06963eb453e5758c55a4fe93c7
SHA256 d9a3d912a63d39b1fc04cb1969b8d70e666f9cc014209779012088a05fdd12dd
SHA512 6cde34d523262b0fb1525af2b6f257508ee72aad3d570b4685d5a2f4f465be29c9dedae2ab516ac5c9fd12165549bcea89ccc5b78369d066f0eaf8551a39e022

memory/4092-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1284-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1284-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4092-16-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4384-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1284-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1284-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1284-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1284-23-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 f128ed336782d9b31c73ea5a3d360c84
SHA1 340841a2442cfa63f2752c683b652d11a4d2d48a
SHA256 8adb166013756fb658f7315e7910388e5832e21fd007eaa1a0fd06dcb2123a51
SHA512 78565219eac6a0363f60b55568716a29649b5b2b18fa87f2b2c7ee5adf1c306a513c8137b8c03104d5bacbfd6085c605aac67a7fbcc47ae8173ee01b94bc2d72

memory/1284-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3632-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3820-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3820-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3820-33-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e1ca214ba1ea92abaede7344d790a6f2
SHA1 a2fed0deb8ebd1e99def6d5db5d5ba499426d66d
SHA256 a82102d45bb6ab54bf1fdb39d305e20082054dea272c24bb72c498136d75f1c3
SHA512 3e57ac26092e7c2dab8357d424dad391079c95b8da8cc4b65f43f100f368bcd1f06364e9955be9db76b07c665dd6c02d58f3df429a389e48a58f60e33675c613

memory/2184-40-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3340-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3340-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3632-48-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3340-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3340-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3340-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3340-56-0x0000000000400000-0x0000000000429000-memory.dmp