Malware Analysis Report

2024-09-11 08:24

Sample ID 240618-qapb7syerk
Target 48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
SHA256 01da2424e710652609c88e99bfbd39c604862ac03a9ac306aa28f0742e43c5f0
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

01da2424e710652609c88e99bfbd39c604862ac03a9ac306aa28f0742e43c5f0

Threat Level: Known bad

The file 48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 13:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 13:03

Reported

2024-06-18 13:06

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2144 set thread context of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2520 set thread context of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2672 set thread context of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2088 set thread context of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2144 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 1912 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1912 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2712 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2672 wrote to memory of 856 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 856 wrote to memory of 2088 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 2088 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 2088 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 856 wrote to memory of 2088 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2088 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2144-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1912-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1912-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1912-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1912-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2144-7-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 79ab91e325509a802a1eb6e4fb78d9f2
SHA1 5da759c9946344eac28f42d3f72f874742e7c567
SHA256 d116051f76593950f031744d65c5aaf721a3c5ef2202106303ed452c3f5ffb6b
SHA512 1f1a0081b1e09868a6c4e6507b427c7cdaf920c49c34745e5c382c346b42a7eb21cc145101527b92c3e30363bdc9a5cc2f1d3eb49c88befcf316f84a97fae9c0

memory/2520-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1912-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2520-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2712-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2712-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2712-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2712-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 7c016d002eee07b43c8412cb2d379263
SHA1 c2740521b92536e321a74099edc78b11abc3c726
SHA256 f915cab6dd6af9065eac8d7d8b4e8559351567c84f656c1096d4b034c5b70f88
SHA512 b2eac5e4838017c751e7cca05e0f8d8a6827e41b7a1031cf9e5408d562b2cb7809fb87708ace43958665a333949e9c227cd2a075f3ce50b280a4d489ad9a447a

memory/2712-46-0x0000000000440000-0x0000000000463000-memory.dmp

memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2672-56-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2672-64-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 44be9cc0cb5b3a3098222a3a09d8c85e
SHA1 11432d1581876ef36ef8c1af295dbab8dd8cfed7
SHA256 1b3f36586d64efc847ad6e492c28874697b0fd53ad85ec47fe5ab877c5ea75c7
SHA512 355bd7c7e8e4094bb519b5824b1a0bafa12e883e0fbf0c380b6f6bb9996df192fcf758e915a55399389e9e7c85ebaa6746588cf01729664d68f7808c9dc50f79

memory/856-71-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2088-85-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2100-88-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2100-91-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 13:03

Reported

2024-06-18 13:06

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1860 set thread context of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 412 set thread context of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2808 set thread context of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3208 set thread context of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1860 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 1860 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 1860 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 1860 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 1860 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe
PID 2300 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 412 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 412 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 412 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 412 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 412 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3260 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3260 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3260 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2808 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2808 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2808 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2808 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2808 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1964 wrote to memory of 3208 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1964 wrote to memory of 3208 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1964 wrote to memory of 3208 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3208 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3208 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3208 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3208 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3208 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\48dc7604485a3daf3350c50de5cc0760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1860 -ip 1860

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 412 -ip 412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2808 -ip 2808

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 304

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3208 -ip 3208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 260

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

memory/1860-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2300-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2300-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2300-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 79ab91e325509a802a1eb6e4fb78d9f2
SHA1 5da759c9946344eac28f42d3f72f874742e7c567
SHA256 d116051f76593950f031744d65c5aaf721a3c5ef2202106303ed452c3f5ffb6b
SHA512 1f1a0081b1e09868a6c4e6507b427c7cdaf920c49c34745e5c382c346b42a7eb21cc145101527b92c3e30363bdc9a5cc2f1d3eb49c88befcf316f84a97fae9c0

memory/2300-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/412-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3260-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3260-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1860-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3260-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3260-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3260-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3260-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2808-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3260-33-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 e0f1fdddf99f5a9f0c6d7e15d824bb1c
SHA1 557125b3c155eb77b51538ae7f41c7f8d23914db
SHA256 b64ad26f4a138f83672a288cfad393e1f572b32a7f32128e5c9a9612acb38a14
SHA512 41721b279e3738c713872c0190e2be0338c800de70914befebfafb560a0c018c1205aa9e9ad5172d82723ee503de50ba1abf13537487875309db083624595987

memory/1964-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1964-37-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8b4c84cc21d478e8e4c444bca7cd9f9b
SHA1 c089a1d665b0641042d83f14fa71d3a24bd7d833
SHA256 bc8d110d33e6ffbecc8e1a92b0d6360bb9edfe5400b948e3143b0ecc45f45092
SHA512 9551473e422e65d9d693d7cd910e8e0a9829d5cf545e6cffdc893cf6ec8737c533ee3882b13c6813539a5dc8562bc9138a3d71dce5b9b8c5ce174f132d8100eb

memory/1964-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3208-45-0x0000000000400000-0x0000000000423000-memory.dmp

memory/264-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/264-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3208-52-0x0000000000400000-0x0000000000423000-memory.dmp

memory/264-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/264-56-0x0000000000400000-0x0000000000429000-memory.dmp