Malware Analysis Report

2024-09-11 08:24

Sample ID 240619-rwkftawhnq
Target c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
SHA256 e93941d6a5c98fad49f8daa385838193df1376353a63eef3bf5fe6242ee986ed
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e93941d6a5c98fad49f8daa385838193df1376353a63eef3bf5fe6242ee986ed

Threat Level: Known bad

The file c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-19 14:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 14:32

Reported

2024-06-19 14:35

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3544 set thread context of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 3024 set thread context of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1340 set thread context of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4316 set thread context of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3544 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 3544 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 3544 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 3544 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 3544 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 1644 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1644 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1644 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3024 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3024 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3024 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3024 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3024 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4448 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4448 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4448 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1340 wrote to memory of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1340 wrote to memory of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1340 wrote to memory of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1340 wrote to memory of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1340 wrote to memory of 3384 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3384 wrote to memory of 4316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3384 wrote to memory of 4316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3384 wrote to memory of 4316 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4316 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4316 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4316 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4316 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4316 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3544 -ip 3544

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3024 -ip 3024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1340 -ip 1340

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4316 -ip 4316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 244

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 171.255.166.193.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3544-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1644-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1644-2-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 58139222f8fbcc68d436c7baeb97edb7
SHA1 1d0064ee875535db7125eef29a7c0f7fa943b861
SHA256 fdefd3d8bbfc4f7ea621416a3e8bf1275d6cc7cb90947dfcfc8bc591b436d6f8
SHA512 44f8b08d6982e53363551a5d39666d9c29da3fa0b0ed7956f59be7b43e6c85baa9206997afff4906bd5193ffbed1077876dd9fc9a6c7e964db733b2fb50a1f6e

memory/1644-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1644-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3024-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4448-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4448-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3544-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4448-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4448-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4448-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4448-28-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1340-30-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 4ba4399ab6d6cf1f3898824feb14e7ad
SHA1 2186fcd66e71183e3f624680ad5344bf251627d6
SHA256 0733c0d8a93efe90c63b6096d1f8d48929ed187f983c3f2d63ea3e5e23b6af2f
SHA512 77ac54776e7a644aa571fdb8a826b2403a3776a9adc159946cf5e5780c6b3962aa5f6529a2c0a6ee57ac00d13b45500efedad0589a0b77987a89db939bab641b

memory/3384-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3384-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3384-37-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a5d9f33e64257fd52d35b903d5c4a987
SHA1 44484afb71cc691fd3d8b1eee2467f2f0d467ec3
SHA256 9005c34804b682189762c2705e866220707e3b3b3e21750f8e677176ef0e8d15
SHA512 06fb1be3ba32d1a6bfec5a8f494ac26b15bcc2275f89332731e623cfb926404b7f8ca66992d66a50c94bd232bc2988bb812c7202d5af68e5b3485d0139c15ae6

memory/4316-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1800-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1800-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1340-49-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1800-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1800-53-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 14:32

Reported

2024-06-19 14:35

Platform

win7-20240611-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2184 set thread context of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2124 set thread context of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2008 set thread context of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2676 set thread context of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 2184 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2124 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2008 wrote to memory of 1432 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1432 wrote to memory of 2676 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1432 wrote to memory of 2676 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1432 wrote to memory of 2676 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1432 wrote to memory of 2676 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\c428167f76e4ea77d9a6008201ab7120_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2184-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1700-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2184-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1700-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1700-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1700-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1700-8-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 58139222f8fbcc68d436c7baeb97edb7
SHA1 1d0064ee875535db7125eef29a7c0f7fa943b861
SHA256 fdefd3d8bbfc4f7ea621416a3e8bf1275d6cc7cb90947dfcfc8bc591b436d6f8
SHA512 44f8b08d6982e53363551a5d39666d9c29da3fa0b0ed7956f59be7b43e6c85baa9206997afff4906bd5193ffbed1077876dd9fc9a6c7e964db733b2fb50a1f6e

memory/2124-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2124-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2620-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2620-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2620-41-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 0cea01b003a0a9511fb100a334d42e81
SHA1 b81679dbd16201ad7777100a039b96b313927662
SHA256 1610e2a356b412d6156d2ac48fcef4ca0b9a7f1087c691c86b7f9a62da2a8e7a
SHA512 201f1852f16e4b060ac0fa8e9063fedacd9405f128e61cbf09c935bb5fcdf680ceea220d9a68abce2a1c54c9927177ea6cacb3156bffc2605f8b18203c49d81e

memory/2620-44-0x00000000020F0000-0x0000000002114000-memory.dmp

memory/2620-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2008-54-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2008-64-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 133ce6cbda8569885edce351535a4116
SHA1 1306d83dd5bddc54a2d387c32ee6fe991fdc803d
SHA256 51a804cb27d6cefa6c9dc8b3cf7683e4433f65172f55c695214850a5f7b3f5a3
SHA512 28497d9093eed49cb041b79a22afdf41ef8e61b1de1a3b1b4434ca541a375a4cf6138ff714ec5b610b2b2350f54dc933592c39efb5c4248d7f8309d72a75f56b

memory/2676-77-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1432-75-0x0000000000230000-0x0000000000254000-memory.dmp

memory/1432-73-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2676-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2072-86-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2072-89-0x0000000000400000-0x0000000000429000-memory.dmp