Malware Analysis Report

2024-09-11 08:28

Sample ID 240621-aj78nstbjb
Target 82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d
SHA256 82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d

Threat Level: Known bad

The file 82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-21 00:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 00:15

Reported

2024-06-21 00:18

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 3012 set thread context of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 624 set thread context of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1236 set thread context of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2972 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2972 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2972 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2972 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3012 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2520 wrote to memory of 624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2520 wrote to memory of 624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2520 wrote to memory of 624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2520 wrote to memory of 624 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 624 wrote to memory of 776 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 776 wrote to memory of 1236 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 776 wrote to memory of 1236 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 776 wrote to memory of 1236 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 776 wrote to memory of 1236 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

"C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe"

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2860-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2972-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2860-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2972-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2972-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2972-1-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7b4004bc07a209c2bc5d1237d7cc9209
SHA1 48ec69da5c988aa3248580abfa49cad4b32ee18b
SHA256 c5f27147d7cf6799d6f32cac068eeb2fc4d53e8c79b54aed39af552a8ed6f18b
SHA512 23b26e8dbc43c866b673a88818544bf06ca2ba87bfbfea49c659d162704dc4394341762da8f5a13dded2e982b07641e76c0196bd90a87ea368fb52d973995a33

memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3012-28-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3012-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2520-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2520-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2520-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2520-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 fb226a5685ffb946b854e2b392d1e008
SHA1 76ee4f8f434f67194f52449664657cbdc490ea85
SHA256 8bc946ea2fa4f2e3ce0d0acecb92ad2e8312955d68d4ae2233d3218259d0cf34
SHA512 579cc51b9f0036d3afee47738b83e07c65802f6684a2978951bfd128cd8c46b0ada4465f6df0991484abeba00b8ae216d6b45ecd01379b3d38a2a281852cf3de

memory/2520-45-0x0000000002150000-0x0000000002174000-memory.dmp

memory/2520-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/624-55-0x0000000000400000-0x0000000000424000-memory.dmp

memory/624-63-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 037917d51161a5f26ab47410bef49659
SHA1 8a171534c53348e4ddb92476faf01581d1d50000
SHA256 fac016b753f681c109a782f64fdacf3b2effde1e6697b1154a2eda7a95695540
SHA512 802d33a9ed79ddfafe3f7caa33120482e91e9c69372dffd0c6784c89017e75647b27403c02b7912efd88d73bf11acd945acdfa706b0f71c48d5daa761f372bb1

memory/1236-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1236-83-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1172-85-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1172-88-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 00:15

Reported

2024-06-21 00:18

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2172 set thread context of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 224 set thread context of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1868 set thread context of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3772 set thread context of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2172 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2172 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2172 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 2172 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe
PID 4660 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4660 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4660 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 224 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 224 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 224 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 224 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 224 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4328 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4328 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4328 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1868 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1868 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1868 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1868 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1868 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2160 wrote to memory of 3772 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2160 wrote to memory of 3772 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2160 wrote to memory of 3772 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3772 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3772 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3772 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3772 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3772 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

"C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe"

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

C:\Users\Admin\AppData\Local\Temp\82b23e58689adf47787583b9ddda43feeb8ad389493e6fdfc3f648d94095f34d.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2172 -ip 2172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 224 -ip 224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1868 -ip 1868

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3772 -ip 3772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/2172-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4660-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4660-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4660-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7b4004bc07a209c2bc5d1237d7cc9209
SHA1 48ec69da5c988aa3248580abfa49cad4b32ee18b
SHA256 c5f27147d7cf6799d6f32cac068eeb2fc4d53e8c79b54aed39af552a8ed6f18b
SHA512 23b26e8dbc43c866b673a88818544bf06ca2ba87bfbfea49c659d162704dc4394341762da8f5a13dded2e982b07641e76c0196bd90a87ea368fb52d973995a33

memory/4660-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/224-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4328-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4328-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2172-17-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4328-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4328-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4328-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4328-23-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 6202806cf82b1210046a11b15e19e346
SHA1 e30ac9501383c5d3ad8f01f54535c3b9dee2db8a
SHA256 8a990d1fe74483349e8c11b9d8c6e827ca22a2e017af92be0836fb079b214d3b
SHA512 91dfdaa5e6b87ee5f980eb74c3a5ee9dc03d4593d8f66f36df9007d13116d273ea058a3faa965b440e0eb4532d6dc8563638b5b533889693832fbdb7fa439dd6

memory/4328-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1868-30-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2160-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2160-34-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b0752284e6f57104273fa162c739738f
SHA1 defc30c206d12e8df2a4438bfa446da85dff3f62
SHA256 b36f7f64d91cc98d005f04664d52410e29eb8e673ecde1b51a58ca9c530b44d3
SHA512 2abe2913f6a4156d0bf9fd010212ebd00d794dea7fd2353997c7676f692582f1392e8cfeec228d08964d6c971b6a744495e5ab2cd710432bb9614e2e8eefbc52

memory/2160-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3772-41-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4672-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-53-0x0000000000400000-0x0000000000429000-memory.dmp