Malware Analysis Report

2024-09-11 08:28

Sample ID 240620-pye8rssckl
Target 636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
SHA256 636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226

Threat Level: Known bad

The file 636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 12:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 12:43

Reported

2024-06-20 12:46

Platform

win7-20240611-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2840 set thread context of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2992 set thread context of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 set thread context of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 792 set thread context of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2840 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2912 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2912 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2912 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2912 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2928 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2928 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1996 wrote to memory of 1776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1776 wrote to memory of 792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1776 wrote to memory of 792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1776 wrote to memory of 792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1776 wrote to memory of 792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 792 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2840-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2912-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2912-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2840-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2912-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2912-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2912-9-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8ddd3b9219a3ba7dbfbfcb20ec0bae8f
SHA1 5a61daaa07928c0c7d071bac49c821ac95dc0861
SHA256 0d2c8d2dd37a06b8870b6e1fc83c9c96c36d90026405476d13524591a4bb29e9
SHA512 fa8a7aa842d2e6675036d36e2d0b025267a974ffd25ea7d7806a13ebe899959711a5470d08990f4889e58318d41773ff0bfa82eb1159110235b79e7befe30561

memory/2992-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2992-24-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2992-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2928-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2928-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2928-42-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2928-45-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 8190845bfd1bfefdde5b07c6aa38341b
SHA1 8321d02c7f6b93f08d1bd3ac28ca031322476557
SHA256 d13059f543d3764bd722fc46f7cd45c36115adf2bfdf74880446e84e4a8ebaf1
SHA512 693caeb50ef014aab887312dd0eec696a81c20f19810d60d1ba264e5562c547a6b30637e854f3f3e40f39f52f4c29775cc5a26efacc83725ebe30d0dd214a66e

memory/2928-48-0x0000000000290000-0x00000000002B3000-memory.dmp

memory/2928-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1996-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1996-66-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 d8dbee55c88cf4a54dbcdefc71f31c49
SHA1 c1e62f27628d0bea28681ee239a0a4cee5b657fa
SHA256 632fb35a73df3de54deccc5b4990b195357607d50efd85f3fad7129537e00cf3
SHA512 ab9e4e395afab2ab1c935ae8cbd5fb8b3b9df2c68f4a6fe80a65e1dc4070700080f796af7307d4cceb44f191a0aec4710ae03fbf1757f9d8edd8a1e80e27a6fa

memory/1776-73-0x00000000003D0000-0x00000000003F3000-memory.dmp

memory/792-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/792-88-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2692-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2692-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 12:43

Reported

2024-06-20 12:46

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 264 set thread context of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 396 set thread context of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2884 set thread context of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1372 set thread context of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 264 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 264 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 264 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 264 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 264 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe
PID 2696 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2696 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2696 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 396 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 396 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 396 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 396 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 396 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2884 wrote to memory of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2884 wrote to memory of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2884 wrote to memory of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2884 wrote to memory of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2884 wrote to memory of 1156 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1156 wrote to memory of 1372 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1156 wrote to memory of 1372 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1156 wrote to memory of 1372 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1372 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1372 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1372 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1372 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1372 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\636543f94098d30089c1953d2300ac92807ba523bcca91e218cf2c3fd67a0226_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 264 -ip 264

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 396 -ip 396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2884 -ip 2884

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1372 -ip 1372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 240

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/264-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2696-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2696-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2696-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2696-5-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8ddd3b9219a3ba7dbfbfcb20ec0bae8f
SHA1 5a61daaa07928c0c7d071bac49c821ac95dc0861
SHA256 0d2c8d2dd37a06b8870b6e1fc83c9c96c36d90026405476d13524591a4bb29e9
SHA512 fa8a7aa842d2e6675036d36e2d0b025267a974ffd25ea7d7806a13ebe899959711a5470d08990f4889e58318d41773ff0bfa82eb1159110235b79e7befe30561

memory/396-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4608-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4608-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/264-19-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4608-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4608-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4608-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4608-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4608-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 760ccf986d70aa45bc8ca913c80bf3c7
SHA1 80567eb339b28563bbe5f16f7679f14a5310a8ee
SHA256 5478d531886a24f3b6a3356f62a8b0c25f3237157bdb24db3a002b09c4032eb6
SHA512 5a9c075f9eb5a21252a9d84976071d71fa4a92eddab1023505ae2b3b45769a70fe6cb436bb7ef3370aad29ca6b961a23a02e1816e4858df985355503d94df6e8

memory/2884-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1156-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1156-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1156-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8958172a4944d7c4bc35a1d91485ef99
SHA1 a4d88406c7b4a44aeccf68ae5f5c9bd71ed7b215
SHA256 f3e72714b242f2877f171c3689a57f1e8a1de243346242af3ff2caa7ddc13aa7
SHA512 d33980a33199bb5d76e6bd269ccab7c73781b9b91aaaf34e3ffe00e88feb8c1b053128f654dd16fde458ce3032eb8d0cf71c2f0f81c5b699b1e8e7b181f1106a

memory/1372-42-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4800-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4800-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2884-50-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4800-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4800-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4800-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4800-58-0x0000000000400000-0x0000000000429000-memory.dmp