Malware Analysis Report

2024-09-11 08:29

Sample ID 240620-m2q4bsxgpj
Target 59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
SHA256 59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa

Threat Level: Known bad

The file 59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 10:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 10:57

Reported

2024-06-20 11:00

Platform

win7-20240611-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2084 set thread context of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2144 set thread context of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1772 set thread context of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1608 set thread context of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2084 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 1944 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2144 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2720 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2720 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2720 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2720 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1772 wrote to memory of 924 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 924 wrote to memory of 1608 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 924 wrote to memory of 1608 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 924 wrote to memory of 1608 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 924 wrote to memory of 1608 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2084-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2084-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1944-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1944-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1944-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1944-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1944-1-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 707df6f92718536432a37725677c88cd
SHA1 78df910aeb42503852dc41ba68ad99f84ba4a431
SHA256 73a0e1e49820c37a6aea064e63da9a193c09b86e33dd1595c93f9875e6dab9d0
SHA512 abcf69aaaa74004e374f75c0c7e8859ebfbbf806ca298a482ae9ab7e67a837c35fca257b5b1c7bbcd40b6b13972e313f20b097654a5b0681b75f0c31097645d2

memory/2144-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2144-30-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2144-23-0x0000000000230000-0x0000000000254000-memory.dmp

memory/2720-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 5a27515712d66dbe7b9f711ec7e419c7
SHA1 d4f3de54cd7c4c29a35c41304e1535f7d317c49e
SHA256 232c6bd6098084318bf5b6857553c244346d492676d964afca383751bc4de683
SHA512 eeb6ffd149529bf9accc90faaad8a24c81c89196e2b643efd18dd6be6c2785f661077a86199aeca4ae438a9d10fb2eb0817951e4532006516130d620a7c78835

memory/2720-45-0x00000000020C0000-0x00000000020E4000-memory.dmp

memory/1772-55-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2720-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1772-65-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 4cc2a7af5684231ad933dea15c3b8d21
SHA1 ace38f108fa84be6aed696ccf643e56fa230f0de
SHA256 8c174378d7230d9c0a707b5d88be8d8744e225a5a80c3c34b3723553d375daf3
SHA512 ea00dc25ef1f0aa048f5ec6304d8d30d1591371697af7fb01c896280814192a11d6842ba5f5a6a2ba481f6b35456a3ea37de9b6228ecf810d698ebe0c06980cb

memory/1608-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1608-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1960-85-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1960-88-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 10:57

Reported

2024-06-20 11:00

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4144 set thread context of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 2692 set thread context of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4384 set thread context of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3648 set thread context of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4144 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 4144 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 4144 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 4144 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 4144 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe
PID 3332 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3332 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3332 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2692 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2692 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2692 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2692 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2692 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3792 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3792 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4384 wrote to memory of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4384 wrote to memory of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4384 wrote to memory of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4384 wrote to memory of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4384 wrote to memory of 4240 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4240 wrote to memory of 3648 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4240 wrote to memory of 3648 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4240 wrote to memory of 3648 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3648 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\59883ed7189f0a39bfa0d6b4948d13dae2caac9a71d335684d3cffd63716fefa_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4144 -ip 4144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2692 -ip 2692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1276,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4384 -ip 4384

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 244

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 171.255.166.193.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/4144-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3332-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3332-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3332-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 707df6f92718536432a37725677c88cd
SHA1 78df910aeb42503852dc41ba68ad99f84ba4a431
SHA256 73a0e1e49820c37a6aea064e63da9a193c09b86e33dd1595c93f9875e6dab9d0
SHA512 abcf69aaaa74004e374f75c0c7e8859ebfbbf806ca298a482ae9ab7e67a837c35fca257b5b1c7bbcd40b6b13972e313f20b097654a5b0681b75f0c31097645d2

memory/2692-9-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3332-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3792-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3792-13-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2692-15-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4144-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3792-17-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3792-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3792-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3792-31-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 b3975aa330e755ba0472a1edb76e890b
SHA1 ec3f5e7feca823e64eec40c349c50ab102fd17d1
SHA256 bc25d18431311737e77c66741b83ca6638a1dee0a78f079faf345e083dfc2c54
SHA512 c0ffd36ef9d89c87088d95b1f2d1049422b147e5cb4d84d3a4d549d227d2d42f8391b360522eb319c257b3e4cdacc1568eeed32ff4c0c23926ec2d443085218a

memory/4384-32-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4240-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4240-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e71f813f07d873165797b9ecd1d3735c
SHA1 38a73d59781f5c612630ee73123cb7207800327c
SHA256 4d9dad76f470632fc230a8ee330bce6f1eaa909dcf1223187f876b97c85af274
SHA512 08b3d881a41c3ddfdf0b3436ad15b6e649d13847fc2cc3178fbb35f553be51866f7cfbb00a5d6fb21a089a997bd13eac2842903941c999fa011c324c6cbf180f

memory/3648-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4240-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/768-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/768-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3648-50-0x0000000000400000-0x0000000000424000-memory.dmp

memory/768-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/768-54-0x0000000000400000-0x0000000000429000-memory.dmp