Malware Analysis Report

2024-09-11 08:25

Sample ID 240619-gph93avgmf
Target 959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
SHA256 5e022ad97643f02dca1260e34e98ecc31736bcef7f9f0691e9138887292f9c9f
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e022ad97643f02dca1260e34e98ecc31736bcef7f9f0691e9138887292f9c9f

Threat Level: Known bad

The file 959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-19 05:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 05:58

Reported

2024-06-19 06:01

Platform

win7-20240220-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2604 set thread context of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2560 set thread context of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1752 set thread context of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1324 set thread context of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2604 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2096 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2096 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2096 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2096 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2560 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2544 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2544 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2544 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2544 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1752 wrote to memory of 1428 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1428 wrote to memory of 1324 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1428 wrote to memory of 1324 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1428 wrote to memory of 1324 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1428 wrote to memory of 1324 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1324 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2604-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2096-13-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2096-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2604-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2096-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2096-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2096-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2096-12-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4a7c221f067c723f7e38e9828be3fc04
SHA1 7cb4cd8b2c7ba16431b459ecc8700acf988841a2
SHA256 5a5cfad106754880c9c9f54a182c89e6cb273182c39731dbcf3472839ac09485
SHA512 cb6f24139bd336d8d9cc07c7ac8e5b21d095928b92e84fd9fd35c4e35c4838bfbea0a4a680c7da9695b2320a67b7b1fd3835319a29a97c43c63ec286bd8eb9af

memory/2096-21-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2560-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2544-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2544-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2544-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2544-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 cd46e5a72f31bf3919c752e80384971b
SHA1 6ed4f89c6842eb9721da5c9d91cd22d29431e161
SHA256 7f91960624561524dc5f2390bf7c197b452d7287c5e407aee94b2ac75efed617
SHA512 f852397379e5bbbf314feff9dea55101cf0e2a74c680df9805bdc1ca27c9d66a9d546ccbc10625fea24809072e5c98003c91f02895cd7af619f01fb4a6da565d

memory/2544-45-0x0000000000290000-0x00000000002B4000-memory.dmp

memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1752-55-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1752-63-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 be01e90ecc7c04f31f72cf8ca90b12a2
SHA1 08a7634efb37fe82c48ed3ea77483688890c5c42
SHA256 52f26435e965399069b93da70876356610a0daedc8dbcb8111bf3827ed858dde
SHA512 ec12ae5ee86b253c36af1b90adde5d0e4d668e47b2bd31168d7412fba6945175fdff03483218dd2e519bd080ad383746df3a4b62ecf1a4b017a1ba51b472883b

memory/1324-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1324-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1704-85-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1704-88-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 05:58

Reported

2024-06-19 06:01

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2644 set thread context of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2540 set thread context of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2240 set thread context of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5036 set thread context of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2644 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2644 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2644 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 2644 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
PID 4660 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4660 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4660 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2736 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2240 wrote to memory of 5092 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5092 wrote to memory of 5036 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5092 wrote to memory of 5036 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5092 wrote to memory of 5036 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5036 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5036 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5036 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5036 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5036 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2644 -ip 2644

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2540 -ip 2540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2240 -ip 2240

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5036 -ip 5036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2644-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4660-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4660-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4660-2-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4a7c221f067c723f7e38e9828be3fc04
SHA1 7cb4cd8b2c7ba16431b459ecc8700acf988841a2
SHA256 5a5cfad106754880c9c9f54a182c89e6cb273182c39731dbcf3472839ac09485
SHA512 cb6f24139bd336d8d9cc07c7ac8e5b21d095928b92e84fd9fd35c4e35c4838bfbea0a4a680c7da9695b2320a67b7b1fd3835319a29a97c43c63ec286bd8eb9af

memory/4660-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2540-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2736-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2736-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2736-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2736-23-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 a560f7069933b6012489976c365297e0
SHA1 ce4153b75f4a7e96d31bd3a7dbdd1d084ca54810
SHA256 eae58ad2727bbfc7a9d75aed641699ec60b791643cd51831639fb97119d389f6
SHA512 c3a46938dcbbb175c149827ac4b54a147cbbe49328125703474b4008cd124f53a32d7aa1f93d31d329d2557c020aa5baf81bd21ae29b3afa233876ac166c250a

memory/2736-30-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2240-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5092-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5092-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5092-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3176-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3176-47-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0d1ec6c91c9c3426f73d815bb047f236
SHA1 9d0828c9a03d948b490f7e17cc8d46bbf7006287
SHA256 0e19db6461cd993cc33617ce683a6ce42b1715751104fb35e825659c3cfd6450
SHA512 1ee85647bbb98af6823763d495f563c729e8a1037c9fd1a92c7c20d64794f95184e5d0024c664f575370f9d0df58d962bea69f85b741ed42356d0d88d6971233

memory/5036-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3176-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3176-51-0x0000000000400000-0x0000000000429000-memory.dmp