Malware Analysis Report

2024-09-11 08:29

Sample ID 240621-ywwx6s1bmc
Target 318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4
SHA256 318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4

Threat Level: Known bad

The file 318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Detects executables built or packed with MPress PE compressor

Neconyd

Detects executables built or packed with MPress PE compressor

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-21 20:08

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 20:08

Reported

2024-06-21 20:11

Platform

win7-20240611-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2060 set thread context of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2992 set thread context of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2152 set thread context of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1784 set thread context of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 2060 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 1832 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1832 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1832 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1832 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2864 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2864 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2152 wrote to memory of 2408 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 1784 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 1784 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 1784 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 wrote to memory of 1784 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1784 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

"C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe"

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2060-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1832-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1832-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1832-11-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e35bb600828cee663c3bb749992d1102
SHA1 5de3a49213b3c31a5d2c70f5dd539bdd4e70d205
SHA256 3a3ab6e9b764f9af0b7d20450eec36ba7f76a364636febf391a282b784d8abac
SHA512 e3ee0bba8cc09ed0979670bad805c8a50f23b532c893c173950060c34f176e5f4ead4dacc290b32666f449703a0a95af9ce7064c7b0fa699290954be3d8340d8

memory/1832-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2060-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1832-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2992-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2992-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2864-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2864-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 355ec3b79d2335861872b2d31305546f
SHA1 d15cca7e4c32aaa70fbb1eed9edb3d58f4c65494
SHA256 374194762e6e90a7e3af2471f3fb0be8ccf110d1e572235812f99e9c49405188
SHA512 8020c5b28d54586ebc76a06ac87dd3c8ac4f29131d90259e913d3586e29d8eb90e1f637839b079523c2e821862822176387c45d61090800c2b5b24d69a9bb663

memory/2864-46-0x0000000002380000-0x00000000023A3000-memory.dmp

memory/2864-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2152-65-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 bca1be289184fc047c342d24977cabfa
SHA1 b09453af9457f5888d4d3234e5dca6721380b934
SHA256 c39ee49b3421f8a3dadc72ee5d6175e7e7f4b9b2a2a6020e1bf0f8e2a65ad792
SHA512 0a016959e0cb37917cbe717e18d43a42971d48d139efbda949401849dd3326f3b48825e30aec352212fcf6068e0c09bac85bc2673f7bd5f0b8a0697b4f24507a

memory/1784-77-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1784-86-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2676-87-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2676-90-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 20:08

Reported

2024-06-21 20:11

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe"

Signatures

Neconyd

trojan neconyd

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3912 set thread context of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 4392 set thread context of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4156 set thread context of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 936 set thread context of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3912 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 3912 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 3912 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 3912 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 3912 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe
PID 5068 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5068 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5068 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4392 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4392 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4392 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4392 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4392 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1804 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1804 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1804 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4156 wrote to memory of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4156 wrote to memory of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4156 wrote to memory of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4156 wrote to memory of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4156 wrote to memory of 340 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 340 wrote to memory of 936 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 340 wrote to memory of 936 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 340 wrote to memory of 936 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 936 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

"C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe"

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

C:\Users\Admin\AppData\Local\Temp\318425f6f71d53d6ada486a3633f478b00dc1ae3afaa41715d61d0bc74d8efa4.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3912 -ip 3912

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4392 -ip 4392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4156 -ip 4156

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 936 -ip 936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/3912-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/5068-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5068-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5068-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5068-8-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e35bb600828cee663c3bb749992d1102
SHA1 5de3a49213b3c31a5d2c70f5dd539bdd4e70d205
SHA256 3a3ab6e9b764f9af0b7d20450eec36ba7f76a364636febf391a282b784d8abac
SHA512 e3ee0bba8cc09ed0979670bad805c8a50f23b532c893c173950060c34f176e5f4ead4dacc290b32666f449703a0a95af9ce7064c7b0fa699290954be3d8340d8

memory/4392-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1804-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1804-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3912-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1804-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1804-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1804-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1804-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1804-27-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 e736fa01e66064658b21b3be17ab9f78
SHA1 a9f2e81cbe12cd0a61121abfeb452d07285be762
SHA256 273878ebc470ba1818a231a86d3e473a90e550cc082f9f763858ee325c4b7c8f
SHA512 1160f9ed9b62f3cd73a564847ff9143b9f767de6a5fcc9c59dfa927ce4f63c561bd44abc501e433f9af960b931b7a6bf463ef9f2347025b900598db346130c43

memory/4156-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/340-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/340-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/340-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/936-42-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 78b6a890fb36e243465eb24cf5bcd5a9
SHA1 a0a7e7da723d2223f62df1219c58a5c9b33311bb
SHA256 0af5a94bdc966f99ddf22d3f6ec986e913e555316651e93ff52a86658ef2e66d
SHA512 ed3ee56d333216cde10523a91e0e79f6aff751792b60bddca2a64ae19e0b356d2cb7f8dfbab214f5a5d0ecf6f3eeed5831d950b50d8add3c11040dc70920325e

memory/1028-46-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1028-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4156-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1028-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1028-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1028-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1028-58-0x0000000000400000-0x0000000000429000-memory.dmp