Malware Analysis Report

2024-09-11 08:28

Sample ID 240619-yjat6syepd
Target 03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
SHA256 03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6

Threat Level: Known bad

The file 03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-19 19:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 19:48

Reported

2024-06-19 19:50

Platform

win7-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2020 set thread context of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2600 set thread context of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2160 set thread context of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1308 set thread context of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2020 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2600 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2612 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2612 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2612 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2612 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2836 wrote to memory of 1308 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2836 wrote to memory of 1308 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2836 wrote to memory of 1308 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2836 wrote to memory of 1308 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1308 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2020-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2076-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2076-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2076-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2020-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2076-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2076-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 17aa07f790c23d3eff89b4e2df6ad9cc
SHA1 0030de1eb2612979da2bbaac44f7003c798bd736
SHA256 1a6370206dd730ff51382ae11218f9874de4e70cd25f328fabca123fd01f75be
SHA512 bb1b5ec6cff6bc9ea33a120c0887bde82f836601bde19ec4b6786a7d46acec7d849349f786843828ddce90618fba302640ada4a3bc4203a69ed6dea1ee01e395

memory/2600-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2600-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2612-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2612-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2612-41-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 0d8e88598f75eac662af28586b962824
SHA1 9b96d9d3b192514affd047ae13168f8cfc56ced5
SHA256 aabf5bf30c9ce494afeafff2ecd35b08b7afed9086edfbc395af1a69b90cf82c
SHA512 a45c480a11fee17ffd64aa7f2cd5ec66dd59263bdee69b3eea66f825418ffd8af1d734750dcee3fa94698352ef90bef42c4f3080e0461946b336f434a20ac7d8

memory/2612-44-0x0000000000290000-0x00000000002B4000-memory.dmp

memory/2612-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2160-54-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2160-61-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 36fc31ad989ff441bfb7351a59476ce8
SHA1 76b8e4e41450ea55445dedc6fcb34e63b4f06b9f
SHA256 8d4f1e2c2c6b913ba2cd925b5d8f81ee6ae05c9e30b9b0e3334673598b84352a
SHA512 d3359e4906268d3da2b0d67f6035b3b70d49664cc086dc2c136d1007eaef6868b1062ed95d1001347dfca7123ca83e4289bd062f4cba0704ca715b86b5f080c2

memory/2836-68-0x0000000000230000-0x0000000000254000-memory.dmp

memory/1308-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1308-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2880-85-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2880-88-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 19:48

Reported

2024-06-19 19:50

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3448 set thread context of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 4856 set thread context of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1464 set thread context of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2968 set thread context of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3448 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 3448 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 3448 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 3448 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 3448 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe
PID 4128 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4128 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4128 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4856 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4856 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4856 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4856 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4856 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3864 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3864 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3864 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1464 wrote to memory of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1464 wrote to memory of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1464 wrote to memory of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1464 wrote to memory of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1464 wrote to memory of 2816 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2816 wrote to memory of 2968 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2968 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2968 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2968 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2968 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2968 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2968 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2968 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\03ee083975d66f6bd7c462cf94df6b97fff2441af6a977756efdb749111e0cc6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4856 -ip 4856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1464 -ip 1464

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2968 -ip 2968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 udp

Files

memory/3448-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4128-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4128-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 17aa07f790c23d3eff89b4e2df6ad9cc
SHA1 0030de1eb2612979da2bbaac44f7003c798bd736
SHA256 1a6370206dd730ff51382ae11218f9874de4e70cd25f328fabca123fd01f75be
SHA512 bb1b5ec6cff6bc9ea33a120c0887bde82f836601bde19ec4b6786a7d46acec7d849349f786843828ddce90618fba302640ada4a3bc4203a69ed6dea1ee01e395

memory/4856-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3864-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3864-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3448-17-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3864-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3864-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3864-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3864-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3864-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 542703ab21485ba50171c7e350685b11
SHA1 02d1af5fe74b4a359ee1f7a6873a58bf939de162
SHA256 50882b88531e7c44912dda7e18f2089d7402ff87fc7a15cbaa93c5a36af1545d
SHA512 82bbdba199563705b447e542e73890d80dea347a461087443339e4b32fdc770371e3183616a3b8d876530ab70f5d1a1a87cf52bf26b905f0ab85b3cf5fc0ef60

memory/1464-32-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2816-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 bf72b94545031c3508b689f0b664859f
SHA1 49b59157411377c77d07d4e4270bddbe70ca6566
SHA256 acf94358029cc75b53f2d441c93ce09db53622f1a8f3505f67b8f76950a92d1f
SHA512 d9cc739c654c105b9299b63202df00a2618504ed619c9a166f0051d05bbe6021603e2baa4e1c1c3ab45500665b4963abe5e586db3e90e9cb751aad85375eefd9

memory/2968-43-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2816-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2816-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1676-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1676-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2968-50-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1676-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1676-54-0x0000000000400000-0x0000000000429000-memory.dmp