Malware Analysis Report

2024-09-11 08:28

Sample ID 240621-jqfaxasajf
Target 5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
SHA256 5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8

Threat Level: Known bad

The file 5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-21 07:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 07:52

Reported

2024-06-21 07:54

Platform

win7-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1916 set thread context of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1744 set thread context of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1032 set thread context of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1304 set thread context of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 1916 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 2212 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1744 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2676 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2676 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2676 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2676 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1032 wrote to memory of 2412 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2412 wrote to memory of 1304 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2412 wrote to memory of 1304 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2412 wrote to memory of 1304 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2412 wrote to memory of 1304 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1304 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1916-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2212-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1916-1-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2212-12-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2212-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1916-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2212-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2212-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 9d722c4b650463dd31ff304ed153f50f
SHA1 9b1ad9d682a35b7c742072b4e5bde57a3003d86d
SHA256 72b772ca68b0264deb329891a78458da3babfd82b9d3372053f76620085565e8
SHA512 d6f092be8696e9429f8b36aab363ac9fcd841d8438d92c273d88db5659cd84ddb60ab72420b8ae9a47cf4b45683ed224a5614edce2cbc39f663d6d051714e121

memory/1744-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1744-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2676-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2676-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2676-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 ad34fb79ab2f7c7109cd5f41d62c5d30
SHA1 960cb4348240ad2d87f10c3e3619ff942ab3ef90
SHA256 b7a672752b37258f85af36dc21efcf7e676adbf168c9bf9649dee4b5cc3891eb
SHA512 12f0d17b617114dab9e0d0d1c0970c0adc4317b0d9a30beb05839a58c98fc574ebe1ca179682058c77ab32c66fd112f9d94bd7f067bacdb36a678fd6544730b4

memory/2676-47-0x00000000004E0000-0x0000000000503000-memory.dmp

memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1032-57-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1032-66-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 865a5f68f5e929dfe6046520f7a8db08
SHA1 9864ef874ba2585527bc4ac228202d2b935d9689
SHA256 33d0a998305b27406f0eaa610f19845d888bc9a6dbfb3939bd88a500f2a50657
SHA512 ab671a92bd043bff913d6dbf139c64c304023dd1088787287585a97c17152ddd8c7ee63c0824360763b5513a0cdd5e8dc8d16478d36ecb3e43e11ae57147bf69

memory/1304-79-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1304-87-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3036-89-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3036-92-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 07:52

Reported

2024-06-21 07:54

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2156 set thread context of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 3856 set thread context of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3204 set thread context of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4656 set thread context of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 2156 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 2156 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 2156 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 2156 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe
PID 460 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 460 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 460 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3856 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3856 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3856 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3856 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3856 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4560 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4560 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4560 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3204 wrote to memory of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3204 wrote to memory of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3204 wrote to memory of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3204 wrote to memory of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3204 wrote to memory of 2052 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2052 wrote to memory of 4656 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2052 wrote to memory of 4656 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2052 wrote to memory of 4656 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4656 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4656 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4656 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4656 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4656 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5126898d4ff5aa51ed59ab8967bf8721cdceb7b9181f898ed5f4074d4aba17d8_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2156 -ip 2156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3856 -ip 3856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 300

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3204 -ip 3204

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 296

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4656 -ip 4656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 264

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/2156-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/460-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/460-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/460-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/460-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3856-11-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 9d722c4b650463dd31ff304ed153f50f
SHA1 9b1ad9d682a35b7c742072b4e5bde57a3003d86d
SHA256 72b772ca68b0264deb329891a78458da3babfd82b9d3372053f76620085565e8
SHA512 d6f092be8696e9429f8b36aab363ac9fcd841d8438d92c273d88db5659cd84ddb60ab72420b8ae9a47cf4b45683ed224a5614edce2cbc39f663d6d051714e121

memory/4560-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4560-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2156-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4560-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4560-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4560-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4560-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4560-27-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 59dc08a52ab1278934e5e00ab9d7e824
SHA1 ee14a274c9f9b7c2a20bc573a5f1ce736879905a
SHA256 98dd9742c035d8ae138f0af05a76e24743e0dbaf3699aa01c9c0abf3d190b271
SHA512 2175b62f87225a8f8cc574ec03da2100239f2ae32eb5b88f339e604aa0bfda4597b2567c7e7bd96a1603df277c48090bf09416ca0b3573e6a1ed98037c3fdb69

memory/3204-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2052-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2052-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2052-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4656-40-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8a88c629cbe5290cc572740ebe3562ac
SHA1 97c14b7d0203171e3f1122f59e2cc644ed1c246a
SHA256 3593e4bf16a37e9b0ee7f95262df3aa2e95853a31448e91e19ddb5a0152b8c31
SHA512 c5eca87450fcba2d0521b6bdb7041d03a539563235db5ce138821def6417ccb73d6d72402b7050efdbae56d01ea6b567657fd2450b5da7e6293eed085522091a

memory/800-45-0x0000000000400000-0x0000000000429000-memory.dmp

memory/800-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3204-49-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4656-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/800-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/800-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/800-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/800-58-0x0000000000400000-0x0000000000429000-memory.dmp