Malware Analysis Report

2024-09-11 08:30

Sample ID 240621-csrcmazell
Target 2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
SHA256 2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613

Threat Level: Known bad

The file 2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-21 02:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 02:20

Reported

2024-06-21 02:23

Platform

win7-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 352 set thread context of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 2432 set thread context of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1860 set thread context of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2880 set thread context of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 2232 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2232 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2432 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2864 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1860 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2764 wrote to memory of 2880 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 2880 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 2880 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 2880 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2880 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/352-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/352-7-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2232-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2232-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2232-11-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ee22b2728166bc4beb3471706d7ee9e7
SHA1 2039c210b1d4538cbd56a0a116aff0c5034e5701
SHA256 c6e25fe50ba56e7cdfe5fdaad0b8fb158e9132ec14ef28aaecc57baf6859a621
SHA512 9f266ba04f310e364b4c009c831621e79790ab14a16a22ee88c302cb7ba8f051d7ab8809a2d6bbc90cb354199b936a8a4182e4a4b9057e1fe0bdd70bb354be56

memory/2232-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2432-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2432-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2864-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 360768c7e9f38afe4f7996b1c5eef065
SHA1 72f9c83bac37749da927ff97f99e86268ac31fe7
SHA256 0151b139c9afe2209ff2d1126c6d6c2037a9d749d58b8cc7c696d1a8e0a31c74
SHA512 a01577305137e7095a78b1565efb11c05d00b0433497c9025e9241095832501b132c0d2c47d102240d19e23759936ee8e9ab9dfaa73169f4a20d3c1562b82964

memory/2864-46-0x0000000000330000-0x0000000000353000-memory.dmp

memory/2864-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1860-56-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1860-64-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 63daa3f21793094b98f96c65d3719d5c
SHA1 76d443af2b4e5340cdb77b62d7f078fa61ce5a9c
SHA256 1a02250d3164965269290eb205b848f44ee80abeaed5f0fbedd26ad6b139f1d8
SHA512 1523297aeeb705d934ecfcdadabf3131591a40ee00061c7caef4d1a7f4efd3731536224d76a9bbb3f8ebd9698aa14e060570a40251bdda58e9a958f8c6c35643

memory/2764-71-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2880-79-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2880-85-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2240-88-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2240-91-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 02:20

Reported

2024-06-21 02:23

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3468 set thread context of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 3592 set thread context of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1952 set thread context of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1864 set thread context of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 3468 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 3468 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 3468 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 3468 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe
PID 1916 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1916 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1916 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 744 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 744 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 744 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 956 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 956 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 956 wrote to memory of 1864 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1864 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1864 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1864 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1864 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1864 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2ef8b61c2adbb09af5ac70a742b646f6bbe57e7bdd070f3e1fe503bd5a539613_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3468 -ip 3468

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1952 -ip 1952

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1864 -ip 1864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3468-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1916-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1916-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1916-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1916-1-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ee22b2728166bc4beb3471706d7ee9e7
SHA1 2039c210b1d4538cbd56a0a116aff0c5034e5701
SHA256 c6e25fe50ba56e7cdfe5fdaad0b8fb158e9132ec14ef28aaecc57baf6859a621
SHA512 9f266ba04f310e364b4c009c831621e79790ab14a16a22ee88c302cb7ba8f051d7ab8809a2d6bbc90cb354199b936a8a4182e4a4b9057e1fe0bdd70bb354be56

memory/3592-10-0x0000000000400000-0x0000000000423000-memory.dmp

memory/744-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3468-19-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3592-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/744-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-27-0x0000000000400000-0x0000000000429000-memory.dmp

memory/744-30-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 35406d02f0099a630a292196d177910c
SHA1 0a7c4b2757cd9090bface392ef8d8c3a694e307d
SHA256 10b6b7dea6beb741f79745370f17d698a56f316f5f3c6ccb4bb7870e132d51a9
SHA512 396370dca4a8af17cefb10d0fe0f3c6b8d209e40642bb63ea602d196962f50804334ac7003ed5fc02467b9f21f8fd241a69f454b32ac4b8370067781867a8be8

memory/1952-34-0x0000000000400000-0x0000000000423000-memory.dmp

memory/956-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/956-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/956-37-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 dd4ad9ea6b975193b29499944e7086da
SHA1 6a8ae085713c9ae32c4fac30c94a28679e306b54
SHA256 0650cc4475f7614dd951bec159bfb35259d3f5c41e44295946620998f5086ee8
SHA512 4517f28b6551b9a1aabdaaec79eea65fe53254442c099da55b01612107709ececd6b40618f625cf990a732c12e5b100d227d9e8c7010b9e18f6290d0ec034e0b

memory/1864-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4344-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4344-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4344-53-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4344-56-0x0000000000400000-0x0000000000429000-memory.dmp