Malware Analysis Report

2024-09-11 08:23

Sample ID 240617-fmq2fszark
Target 4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
SHA256 487d5d95f1ddfb0daf9013d74c20b5df99e35ab812c3a0c9e54cd35ec1dda9f3
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

487d5d95f1ddfb0daf9013d74c20b5df99e35ab812c3a0c9e54cd35ec1dda9f3

Threat Level: Known bad

The file 4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 04:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 04:59

Reported

2024-06-17 05:02

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2400 set thread context of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2604 set thread context of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1840 set thread context of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 864 set thread context of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2400 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 2760 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2604 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2628 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2628 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1840 wrote to memory of 2300 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 wrote to memory of 864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 wrote to memory of 864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 wrote to memory of 864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 864 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/2400-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2760-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2760-14-0x00000000002B0000-0x00000000002D3000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d12a5b88a2ec9f541b9529e0dde5fe4d
SHA1 6a605456db45eb5ccb9aedeb04c2468ae318aab9
SHA256 4b3fe7a793d587f9efc5102a11655dd4313c3851cafcdeb9b5661548228620e5
SHA512 a5c3366036401c93cb558254651267e97bb335398f5a8389e2f89372dd7569f1ec42d32e782b9553eee44d0128300020fdaede649bcbaae00e64dd8a606efb45

memory/2760-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2760-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2400-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2760-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2760-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2604-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2604-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2628-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 a9aa7c81bef908e141406119c6a1ba76
SHA1 da91a3bc13d4578679992eda7d0496d9a76432d6
SHA256 e8b8e13ad6e1851ec2513cb17f9e442285c98e6c8cf0f5d4fa3d345ce13424fc
SHA512 c9e31d5bf42cd944f3af2b2835cb180705a8e2211c6bb5d67a631a185aa9223c6089156b156b558ecfc675f78dbedca6d8ccec6bf65b4abffd033326e2fc8af6

memory/2628-47-0x0000000000430000-0x0000000000453000-memory.dmp

memory/2628-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1840-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1840-66-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 942be052f709b60ce891c3058d16877d
SHA1 0d690690ca9e5b7c84e051dbb009f12249417afb
SHA256 a067ddb797e126e2b521d5bdb269f49e430788facfe353891d628951066aff14
SHA512 dad7c0b11d82120d41a0b39b4d466b1c1dff64bda28c56f0f033f357a12beaf9bc65afe463a9f6426e3920d6c0e2659fb626327b3ad3a427eaffd5cd7705bc12

memory/2300-72-0x0000000000230000-0x0000000000253000-memory.dmp

memory/864-87-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2248-89-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2248-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2248-93-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 04:59

Reported

2024-06-17 05:02

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1716 set thread context of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 3004 set thread context of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4408 set thread context of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3436 set thread context of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 1716 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 1716 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 1716 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 1716 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe
PID 668 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 668 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 668 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4408 wrote to memory of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4408 wrote to memory of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4408 wrote to memory of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4408 wrote to memory of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4408 wrote to memory of 2172 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2172 wrote to memory of 3436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 3436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2172 wrote to memory of 3436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3436 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3436 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3436 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3436 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3436 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4d7946438aad2fe086abb75e5c7ac310_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1716 -ip 1716

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3004 -ip 3004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1984,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4408 -ip 4408

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 304

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3436 -ip 3436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 226.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 107.116.69.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1716-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/668-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/668-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/668-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/668-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d12a5b88a2ec9f541b9529e0dde5fe4d
SHA1 6a605456db45eb5ccb9aedeb04c2468ae318aab9
SHA256 4b3fe7a793d587f9efc5102a11655dd4313c3851cafcdeb9b5661548228620e5
SHA512 a5c3366036401c93cb558254651267e97bb335398f5a8389e2f89372dd7569f1ec42d32e782b9553eee44d0128300020fdaede649bcbaae00e64dd8a606efb45

memory/3004-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2408-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1716-19-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2408-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-27-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2408-30-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 b0160bd169ad627bfa6bc532a4ab9a22
SHA1 17ba0b7e2100fafeea863602d641b613b658f1fe
SHA256 ff31ba30d2b609095bdd01d4db4c2e42908036cdb51abd303b7fe9869c9b7d63
SHA512 77f57a3792c06c3f025f4e108da445cb360dbbac9e709b9d3563f29fe9c6c3b728b23963f25f0f61e793677ab7a3b8b5ee446757eaed28e690d1d1297cdf6de9

memory/4408-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2172-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2172-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ea9ca83289446ee508545ad6f8500d60
SHA1 f64ebdbc65a4289d7b0fea4507b7f599e9ffa1c7
SHA256 088a049b04db3f28af9039e4134fac67eef1d3270ea46814de208eb59c015180
SHA512 a4c359bf05c7cde8117cd12eb6316095bcb2f3c5717796f6933ad736c163b54f4c9da90a7ae142a84856f7b2fa2d28523278cfe29eb1e33fa36e2ce1397a8733

memory/2172-42-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3436-45-0x0000000000400000-0x0000000000423000-memory.dmp

memory/748-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/748-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4408-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/748-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/748-57-0x0000000000400000-0x0000000000429000-memory.dmp