Malware Analysis Report

2024-09-11 08:23

Sample ID 240617-dlcrbswamr
Target 3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
SHA256 e27dab0d47fb76223d85fbf1d88aedce2f7237cb4163c889678ac54f1a3d03ee
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e27dab0d47fb76223d85fbf1d88aedce2f7237cb4163c889678ac54f1a3d03ee

Threat Level: Known bad

The file 3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 03:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 03:05

Reported

2024-06-17 03:08

Platform

win7-20240611-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1168 set thread context of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 2640 set thread context of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1728 set thread context of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1908 set thread context of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1168 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 2680 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2680 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2680 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2680 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2640 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2648 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1728 wrote to memory of 364 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1908 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1168-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1168-1-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/2680-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2680-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2680-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2680-12-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2680-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1168-8-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 3af1297eece8e65e6c8709905c65ca3e
SHA1 77bd5cf1e9dbd2cd5ccc2b6eb7b30343637a699e
SHA256 4036220f103940e02abbfacf59ffa5017db8e276cb7f448ca549bb5304c78944
SHA512 4be08361c7c1e2630234b7759ab1ebee9d12dd4c1475a8cb80c2c11b61ee23a83bb6b9a62765e98b95bea6b9a0dea3c8d7d016adcddd1d21b5d624fbec2f47d6

memory/2640-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2640-25-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/2640-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2648-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2648-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2648-42-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 9a3dea8498fa7f777425d39d2b98bfdd
SHA1 b686ff0d0ded1dd7a81be5fa588e6aa86f9ceeff
SHA256 dc26e75127a346348dd8950190162c2b50a1bcd2561a8bb178b28d39d9c87709
SHA512 fb46748a01d4e9743ed0067b0af9e340cb2da0887d300f83f01cda407e84c5c5c03adfd7cc3004922d49a8f7e43518cc8832f8dadd0d82737e609a312f780a10

memory/2648-48-0x0000000000530000-0x0000000000553000-memory.dmp

memory/2648-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1728-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1728-66-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 cc22e6818cba13eafcd695df92756ba4
SHA1 81f9f7c40015322b6d10befca6910973649eab74
SHA256 5013c3850fe9b985e640c70dd020fc93c816c4359d8ac8513bac8f1b4b833e31
SHA512 66bdfc9ae2079165f87b47a23fb7b22a2b8f68cb4de2a39116c3d55a782c82510aac7e88316bce2a4674602baf338c32d979a38afc5e26212e1f53888c5f2498

memory/364-73-0x0000000000230000-0x0000000000253000-memory.dmp

memory/1908-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1908-88-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1628-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1628-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 03:05

Reported

2024-06-17 03:08

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1504 set thread context of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 4576 set thread context of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4524 set thread context of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 548 set thread context of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1504 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1504 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1504 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1504 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 1504 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe
PID 5016 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5016 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5016 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4576 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4576 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4576 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4576 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4576 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4128 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4128 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4128 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 wrote to memory of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 wrote to memory of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 wrote to memory of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 wrote to memory of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4524 wrote to memory of 4916 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4916 wrote to memory of 548 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4916 wrote to memory of 548 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4916 wrote to memory of 548 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 548 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 548 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 548 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 548 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 548 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3c4e37612eae47d79a757385cd0c8990_NeikiAnalytics.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1504 -ip 1504

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2528 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4524 -ip 4524

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 548 -ip 548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 268

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/1504-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/5016-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5016-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5016-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 3af1297eece8e65e6c8709905c65ca3e
SHA1 77bd5cf1e9dbd2cd5ccc2b6eb7b30343637a699e
SHA256 4036220f103940e02abbfacf59ffa5017db8e276cb7f448ca549bb5304c78944
SHA512 4be08361c7c1e2630234b7759ab1ebee9d12dd4c1475a8cb80c2c11b61ee23a83bb6b9a62765e98b95bea6b9a0dea3c8d7d016adcddd1d21b5d624fbec2f47d6

memory/4576-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4128-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-12-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5016-13-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1504-15-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4576-16-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4128-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-24-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 5fc2fa1ae45985517f26718ae4a1d0ef
SHA1 e162674efa42032719b0bac2e10d66999250bf86
SHA256 a3467c5196fe0a44e23d0427e4074ca0c638085da5a0057cf6ad615d3afe9208
SHA512 ce6a65a763476271707778be3add0cd76e298a151ad6a82bc2c7ef5a88daea037e6389be8f0c968e0c34c402ac051f3d07c159c2013e0aa99159a78108766d02

memory/4524-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4128-30-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4916-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4916-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4916-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 340ee16257b911d02e6521ceb8f8058f
SHA1 4c47e7cbd012002fcf8108f164207c537a995c69
SHA256 df5e34f828985492c1e6b5726be88800795bfd6786e8526c132ac3cd26883507
SHA512 f17f56d67d103a31c859b887be354c41da39bcafff315fccdda2bce8ae36eb3689365e03791e568d0c057c24c829bb5232cd9b7ce8822e97ed37c0d19d3d59fa

memory/548-43-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1688-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1688-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/548-50-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4524-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1688-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1688-56-0x0000000000400000-0x0000000000429000-memory.dmp