Malware Analysis Report

2024-09-11 08:28

Sample ID 240622-c2g6baxflq
Target 79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
SHA256 79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c

Threat Level: Known bad

The file 79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-22 02:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 02:34

Reported

2024-06-22 02:36

Platform

win7-20240221-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3020 set thread context of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3056 set thread context of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2016 set thread context of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 set thread context of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 3020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1996 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1996 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3056 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2556 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2556 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2016 wrote to memory of 2760 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2760 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2760 wrote to memory of 868 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/3020-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3020-1-0x0000000000230000-0x0000000000254000-memory.dmp

memory/1996-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1996-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3020-10-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1996-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3056-21-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 120b13ff0d8b53d791a48b23079a475b
SHA1 4779d30d10b2f8aacdf96fe1eb33c7b009af81c7
SHA256 786dadbde3caf3c9c2208cad7c6ecf521660768e332bc4baf5a75bae4fc047b5
SHA512 0e64268c6356f715022548a034877335737dc4a3719cb18ed78493e781608feafa99840799bb49aa9f3f07d88da7ecd378a1c37a7fa87f4242da27fd18b6244b

memory/1996-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3056-24-0x0000000000230000-0x0000000000254000-memory.dmp

memory/3056-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2556-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2556-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 b05e3f9f0132c1c50481e7f9c4b86de7
SHA1 ca500ae65ff922af4d28035a3c7daabf7a6f4c4c
SHA256 b98f2d7c136326fe818ca2fdf988dc355a2588996f52e0cb9d381ea035cb67e5
SHA512 f9efc0055b6dc70e93d5834588e74daae1e631910d2b70fbd2f9041b7e050db560b17de7f6dc0699176b41a8bdf365d9967666d5683e29a2c9a00b8cac789232

memory/2556-46-0x00000000002A0000-0x00000000002C4000-memory.dmp

memory/2556-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2016-56-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2016-65-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a5ba1a7a4e024a27b4ce64b42e3beb5c
SHA1 955bd007639d25460cd7a45ec4cb6cf6b2e34651
SHA256 ab218b1b0e55defbf5c245419f1ed42a98c307b16eaf5df643d923ec32a53bad
SHA512 6594a91602fec6c495f2ceabb53efbfdaa5ad468fd33bd6c2b7c52d99ab6dcd03ade34476d8857063e176505045b8220b189b413c6f265d894b40eba06e814ef

memory/2760-70-0x0000000000230000-0x0000000000254000-memory.dmp

memory/868-78-0x0000000000400000-0x0000000000424000-memory.dmp

memory/868-85-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2272-87-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2272-90-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 02:34

Reported

2024-06-22 02:36

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1836 set thread context of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 4268 set thread context of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5064 set thread context of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3792 set thread context of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe
PID 1272 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1272 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1272 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4268 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4268 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4268 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4268 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4268 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3400 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3400 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3400 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4992 wrote to memory of 3792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4992 wrote to memory of 3792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4992 wrote to memory of 3792 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3792 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\79e58e42ba64ec7c1f787f6b63948d48d47d6a580c8dc68727e84a76fa32919c_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1836 -ip 1836

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4268 -ip 4268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5064 -ip 5064

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3792 -ip 3792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 171.255.166.193.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/1836-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1272-7-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1272-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1272-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1272-1-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 120b13ff0d8b53d791a48b23079a475b
SHA1 4779d30d10b2f8aacdf96fe1eb33c7b009af81c7
SHA256 786dadbde3caf3c9c2208cad7c6ecf521660768e332bc4baf5a75bae4fc047b5
SHA512 0e64268c6356f715022548a034877335737dc4a3719cb18ed78493e781608feafa99840799bb49aa9f3f07d88da7ecd378a1c37a7fa87f4242da27fd18b6244b

memory/4268-11-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3400-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3400-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1836-17-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3400-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3400-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3400-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3400-27-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 66a052867a9e00d9e3d685cd7d70820e
SHA1 e99c3adee5d9a9abc25962c6d35110dc68d352ef
SHA256 00e0e888fd6880f33657fabf75bdfee30e5a6171789996836735e9c498d89999
SHA512 231e1b1ea3b0d27a4467e47c911fe17433fc8ec403ba6be9ea42524278182fc3aabb3c10119bc12be2fcdf0f1edf266de8228ca4e186f371c11beb0be8ad76c7

memory/3400-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5064-35-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4992-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4992-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4992-38-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 13c18f62c4c7b35704cdb50d16890f91
SHA1 1f559c60869c3ffbc8dacc34522b8ca32900abe7
SHA256 c58d597a1059a9d9187ac29f562dd1ac941e113abc5e343e6a2ed2f7e5392816
SHA512 7dcacb8ef130bd51d0f1aabf0d59b4ee44160d5c614ba27d2f0216bd509c213191399a40e1ac0b46e65c056173f06e0cfc249f9b28432a1e95fb63a2e20c8368

memory/3792-45-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3412-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3412-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3412-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3412-55-0x0000000000400000-0x0000000000429000-memory.dmp