Malware Analysis Report

2024-09-11 08:30

Sample ID 240623-mnfenssdlq
Target 61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
SHA256 61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3

Threat Level: Known bad

The file 61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-23 10:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 10:36

Reported

2024-06-23 10:38

Platform

win7-20240220-en

Max time kernel

148s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2176 set thread context of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2364 set thread context of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2408 set thread context of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1444 set thread context of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2176 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 1592 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1592 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1592 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1592 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2364 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2540 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2540 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2408 wrote to memory of 2616 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2616 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2616 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2616 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2616 wrote to memory of 1444 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1444 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/2176-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2176-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1592-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1592-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1592-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1592-12-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1592-3-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b149d293a0ed8334945013506df70f8b
SHA1 66ac12845a9efaf9d4bceba08e074bccc32d5123
SHA256 dd1090d5b6ee1dae44355f82ea9a02b910c1129d009457a514f60c28ccce1581
SHA512 c213cf67686315d8c375faf788d6aac42f2763a65f470db6449d95dcb6d2341046ef6af44fbdbce0851b993cc5047016bca8bc8e1b5fc5fdcb7629c10571f377

memory/2364-22-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2176-1-0x0000000000230000-0x0000000000253000-memory.dmp

memory/2364-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2540-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2540-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2540-44-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 ca5f75490773ad0d7714eb14341ecf89
SHA1 0fe35ff58173878663f9c8b7ba8aff890131a208
SHA256 486fae5d7efb48eaeefc26d90e4752b38500b3be9ead5266f325db15649c07af
SHA512 0a776660bf9de1ab4ece8032a8447b081b20e1c76d5c806c2ef6c778de8588a0b0b75f43535c913ce378b72c143b2bbaaf8cb75149ccf84f99ea9ba93be035b8

memory/2540-54-0x0000000001F90000-0x0000000001FB3000-memory.dmp

memory/2540-56-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2540-53-0x0000000001F90000-0x0000000001FB3000-memory.dmp

memory/2408-58-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2408-66-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2616-73-0x00000000001C0000-0x00000000001E3000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a6ae4bb98113b33cbf6f2d3bd00ab483
SHA1 f9d5a58a6dec68439d9beac65bf3a52f26596308
SHA256 327cabf4d711a04abafb3b1402f1ae6d07757775297bdf4de8a6a8d52b5347a3
SHA512 6ef148c24a90b504f077a7c68e2f74c9d69bdd5cfc7b89698fd0b17338c5704b60b4cf69cdf84ae049e2f07531ca75653a7cd2125e847518432766bb41f5bef7

memory/1444-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1444-89-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1248-91-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1248-94-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 10:36

Reported

2024-06-23 10:38

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1008 set thread context of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2832 set thread context of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 5032 set thread context of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4144 set thread context of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1008 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 1008 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 1008 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 1008 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 1008 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe
PID 2628 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2628 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2628 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2832 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2832 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2832 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2832 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2832 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1560 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1560 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1560 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5032 wrote to memory of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5032 wrote to memory of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5032 wrote to memory of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5032 wrote to memory of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 5032 wrote to memory of 1008 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1008 wrote to memory of 4144 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1008 wrote to memory of 4144 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1008 wrote to memory of 4144 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4144 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\61d34a63868a3855222b79dab01a8b938950c5cac64d6ab1279aa3062426bed3_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1008 -ip 1008

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2832 -ip 2832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 5032 -ip 5032

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 292

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4144 -ip 4144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 244

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 16.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/1008-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2628-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2628-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b149d293a0ed8334945013506df70f8b
SHA1 66ac12845a9efaf9d4bceba08e074bccc32d5123
SHA256 dd1090d5b6ee1dae44355f82ea9a02b910c1129d009457a514f60c28ccce1581
SHA512 c213cf67686315d8c375faf788d6aac42f2763a65f470db6449d95dcb6d2341046ef6af44fbdbce0851b993cc5047016bca8bc8e1b5fc5fdcb7629c10571f377

memory/2628-7-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2832-11-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1560-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1560-29-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 58dd4558995f2d621284d7b27239b20e
SHA1 932720096ad94368bf6d34454853bac330dd8988
SHA256 61a0c535af34ad5db12f456d09d4d54f32abc8f2521b6498b14a6468a8a5508f
SHA512 4c72ee11b36b870ba093a3d50b55afa2ba4323906a6e9d72e62158ede7fe628a8d90092017a38e5fb8e26e0b818838054a759cb07ef5c5404f7c4b8f854b8dde

memory/5032-32-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1008-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1008-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4144-43-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1008-42-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 2de7898273669abaf3d8e5ac1dcee03b
SHA1 279c55ffe08f8c81cb0d667dfc3ca86bcc4e71b6
SHA256 40f833a83aaa5c9524c2f92176d2e47200040fefc99d78c10e64e66a59dd3d85
SHA512 be9cafbbd56950013a035f904d85a006f9e9c6e75f2080a1be5cb0b7817ee43b1eacf489b814b5f12ca5075e346f23e527259ffe69b432fc0447c7879467d852

memory/2132-47-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2132-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5032-50-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4144-51-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2132-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2132-55-0x0000000000400000-0x0000000000429000-memory.dmp