Malware Analysis Report

2024-09-11 08:21

Sample ID 240618-mwmtqathrk
Target 3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
SHA256 cdae2ac36a74ac1a927a24784ab65549b0b036d5b16d5a5792a27909dd4d9d08
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cdae2ac36a74ac1a927a24784ab65549b0b036d5b16d5a5792a27909dd4d9d08

Threat Level: Known bad

The file 3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 10:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 10:49

Reported

2024-06-18 10:51

Platform

win7-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1252 set thread context of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 2140 set thread context of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2572 set thread context of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2420 set thread context of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1252 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 2000 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2000 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2000 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2000 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2140 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2796 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2796 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2572 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 2420 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2420 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2420 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2420 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2420 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

memory/1252-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1252-7-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2000-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2000-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2000-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 581830fd496d40c3b617f50d9e59d6ff
SHA1 e95170163da38211cc9ed65d16ddfdcb5d0ab1a1
SHA256 f654e1f715d680b77b9ea2f82a7e79d1c08f096ebb64b5535d26ab3f7b9273bb
SHA512 f48f8f5f1cd4706304abf66ad1882dcd4510ada4d7335e0dc0cf3f0c11198fa925cd3088efb087157684ff84cb61cb4699057796d7793949d58f31cfe505bad2

memory/2000-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1252-1-0x00000000003D0000-0x00000000003F4000-memory.dmp

memory/2140-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2140-25-0x00000000001C0000-0x00000000001E4000-memory.dmp

memory/2140-22-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2000-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2796-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2796-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2796-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2796-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 5d3fca404f6067093a61ffed32f709ba
SHA1 528e8e82bb8a39e3340d51181f0c578c8534e25b
SHA256 e50e52f97f0ac7681d9d1a4df1332cc1cb86ecd382fc15a22a8ac12ee5477b12
SHA512 d1c60fea0b9aaee54eb4bf8f236f3eb45f02538dcb2150d79598c2ef4febbb84a7ac6289e206b985bb0a30a3f715cffb267ce710284f6f12dcfa45134f654066

memory/2796-47-0x0000000002110000-0x0000000002134000-memory.dmp

memory/2796-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2572-64-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2420-77-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 259c5c731c8f855810607e52a330cb28
SHA1 b55eb2fc8f1c9d4433748329699b0d20445becd9
SHA256 02c516732eedfaeda25d43f9279431b2fe1d8ad02fc88fa3b0724603b919fa5c
SHA512 3e07779fb94e0bdf66c0805ae5d3d4a832ddd198e7f1fe4fcc25c3729c87a095de05324897a558df8b8a92d754832ac34433b047094fc6a514defa5e560a1747

memory/2420-85-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1268-86-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1268-88-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1268-90-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 10:49

Reported

2024-06-18 10:51

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1044 set thread context of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 2920 set thread context of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1584 set thread context of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3796 set thread context of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1044 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1044 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1044 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1044 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 1044 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe
PID 232 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 232 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 232 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2920 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2920 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2920 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2920 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2920 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3060 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3060 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3060 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1584 wrote to memory of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1584 wrote to memory of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1584 wrote to memory of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1584 wrote to memory of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1584 wrote to memory of 4232 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4232 wrote to memory of 3796 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4232 wrote to memory of 3796 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4232 wrote to memory of 3796 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3796 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3796 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3796 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3796 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3796 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3b0bb2d7e1f2b827d845f6030a48b9b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1044 -ip 1044

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2920 -ip 2920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3912,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1584 -ip 1584

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3796 -ip 3796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1044-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/232-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/232-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/232-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/232-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 581830fd496d40c3b617f50d9e59d6ff
SHA1 e95170163da38211cc9ed65d16ddfdcb5d0ab1a1
SHA256 f654e1f715d680b77b9ea2f82a7e79d1c08f096ebb64b5535d26ab3f7b9273bb
SHA512 f48f8f5f1cd4706304abf66ad1882dcd4510ada4d7335e0dc0cf3f0c11198fa925cd3088efb087157684ff84cb61cb4699057796d7793949d58f31cfe505bad2

memory/2920-9-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3060-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3060-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1044-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2920-17-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3060-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3060-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3060-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3060-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3060-28-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 c99741e9f1125dba65b134ea55bb5d78
SHA1 ac211f14525c97570b3de3c88f04d36b397df800
SHA256 979b5cd9a17ef3685c458dc949018d103fc08c6afe358370024da90941968649
SHA512 5cfbf4505ef8d696aaa95171e4c058821139165b4a07ca4e67e1d0c0c0439c20156259de9813e1b37daaba6e646506172aaf260f298ccceac90b180a989e5b28

memory/1584-32-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4232-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4232-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4232-35-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fbdefe88ebd62c19911cb8e6df4b5442
SHA1 837c581ef82a82659e577db05fb6b6c6ac059ef1
SHA256 3f56b7ae12b72ae301a564b59c4617d065431be5c02514ee8e2c3e22afd15aa1
SHA512 914f60ebb0cd267f15b508d791d80b7bb09f797a7c3b2d6b7b34ac58db50a13852d148f161e9247878c7f8a20e89a1966443c1774fd3f3b62b3233c74e4c78f6

memory/3796-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4540-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4540-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4540-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4540-53-0x0000000000400000-0x0000000000429000-memory.dmp