Malware Analysis Report

2024-09-11 08:24

Sample ID 240617-zyd1taybqn
Target 028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
SHA256 53e5e852228ed1f8c8133d502d1f22f915f9a4b9f92667ed29281038eb2d5376
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53e5e852228ed1f8c8133d502d1f22f915f9a4b9f92667ed29281038eb2d5376

Threat Level: Known bad

The file 028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 21:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 21:07

Reported

2024-06-17 21:09

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2252 set thread context of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2540 set thread context of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 672 set thread context of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 588 set thread context of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2252 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2528 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2528 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2528 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2528 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 672 wrote to memory of 1520 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1520 wrote to memory of 588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1520 wrote to memory of 588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1520 wrote to memory of 588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1520 wrote to memory of 588 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 588 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2252-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2732-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2732-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2252-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2732-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 87ce9d5bafb384a324529e278057fe1f
SHA1 ed90644cdb0084325dadeaf7aeee4361b9e8d663
SHA256 15142b6ed8c5279f931516a225c8b0d5b4eb5b6f27516053480f6dc7436ef0ac
SHA512 68af99bdda8f935ef7fdf2ac1ea03359334d04e6b266b1c37d3d6c62c5a0b37c67286fb66d2b35b65ccbd59764fb25434d3d48622e76e6e216d9d4d5ce3806cd

memory/2732-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2732-18-0x00000000005C0000-0x00000000005E3000-memory.dmp

memory/2732-17-0x00000000005C0000-0x00000000005E3000-memory.dmp

memory/2732-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2540-23-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2540-26-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2540-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2528-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2528-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2528-46-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 eb7adfcf30b929fba9687569cdf321cf
SHA1 47dc14e837be876b7f6c8fe7dcd3ad681306fc19
SHA256 5107c608496191e8a6800513010a36206162769427c6466cb54ff9fe26743cad
SHA512 26cbea45bc07a36590637e7f8a862671804ef371c04cc3b0a472092f8160f4473a0477413fee1015264b8fad8501d7ea6df1397d2db1bb44d958e5d7248de47c

memory/2528-49-0x00000000003A0000-0x00000000003C3000-memory.dmp

memory/2528-57-0x0000000000400000-0x0000000000429000-memory.dmp

memory/672-67-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a02a172912d93de15e5c16abc648123a
SHA1 176c9045023cbb316426eee3cb1ba9b7d3b32330
SHA256 b862985aa587670793c4f5fa1aa1a57856a0ddbb126be665dd146f9d92454897
SHA512 80d59317d24859ea099a30997c2881980332447e79344eec43e8e3bb692c40ad9d7429fdbe80331207c43c39ee4a85270b4163d01f18252bc3d7a180a863548c

memory/1520-79-0x0000000000230000-0x0000000000253000-memory.dmp

memory/588-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/588-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1464-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1464-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 21:07

Reported

2024-06-17 21:09

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 116 set thread context of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 4440 set thread context of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2616 set thread context of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2436 set thread context of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 116 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 116 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 116 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 116 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe
PID 380 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 380 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 380 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4956 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4956 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4956 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1196 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1196 wrote to memory of 2436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1196 wrote to memory of 2436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1196 wrote to memory of 2436 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2436 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2436 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2436 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2436 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2436 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\028608a36f9f35248232e75da6ec2b30_NeikiAnalytics.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 116 -ip 116

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4440 -ip 4440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2616 -ip 2616

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2436 -ip 2436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 244

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/116-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/380-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/380-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/380-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 87ce9d5bafb384a324529e278057fe1f
SHA1 ed90644cdb0084325dadeaf7aeee4361b9e8d663
SHA256 15142b6ed8c5279f931516a225c8b0d5b4eb5b6f27516053480f6dc7436ef0ac
SHA512 68af99bdda8f935ef7fdf2ac1ea03359334d04e6b266b1c37d3d6c62c5a0b37c67286fb66d2b35b65ccbd59764fb25434d3d48622e76e6e216d9d4d5ce3806cd

memory/380-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4440-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4956-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4956-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/116-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4956-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4956-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4956-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4956-23-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 f465177819fee4a6b4ee375ea5211a6d
SHA1 de1b1a8046109ae96fda98696867b6b33585b925
SHA256 b2f70a90006cdf09f6274ef04a0daba938ae523b1a83c847187a562512e49f28
SHA512 89f02e7c4f0c9877c94afd151e29146cc0c9d6b702a16b8a05c5b19497fe340bc9ea6ac7f128000951b1f207bdda15412595c4e76292a3cd834ca52defb99838

memory/4956-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2616-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1196-34-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 f89b1a9e899fd87ea2472fb765d2de6c
SHA1 be7e112ccdf3abb88102d6660f32b7696c8e3f14
SHA256 9ad0f97559c635741d5520910dd31d8e6a1178fd905ffd4365993df3a23bc62f
SHA512 3ca67a1fe9da2de80b65da01733c75ac7df165f2e586b623de1e36f3e257597660fa5db1d3c5a07b92425746264e6afa8b49be9d79437ced9b13985d30500bf2

memory/1196-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1196-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2436-42-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2616-48-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1052-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1052-56-0x0000000000400000-0x0000000000429000-memory.dmp