Malware Analysis Report

2024-09-11 08:28

Sample ID 240623-n44ymstbrk
Target 6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
SHA256 6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6

Threat Level: Known bad

The file 6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-23 11:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 11:57

Reported

2024-06-23 12:00

Platform

win7-20240419-en

Max time kernel

141s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2952 set thread context of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2892 set thread context of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1272 set thread context of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1528 set thread context of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2952 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 3016 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3016 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2892 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2648 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2648 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1272 wrote to memory of 2744 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2744 wrote to memory of 1528 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2744 wrote to memory of 1528 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2744 wrote to memory of 1528 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2744 wrote to memory of 1528 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1528 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/2952-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3016-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3016-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3016-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2952-8-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3016-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0b5fee4909cb90d48d71a5c6670417d9
SHA1 00a9058e9d952e07e09c19f45cd37368c22185ad
SHA256 0b74ecbc1fc23ca4830dfd05c4f8fa5bdf452fa4455998d7c387f2657cc60902
SHA512 751b6c7f59993d3647149571bd5aaa7d2bb6a594e567e613643457c8c6add7821e58ab1756bf95a1b89e7a02c467a4fbea47d1dedfe3687a7c181e191cf61f35

memory/3016-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2892-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2892-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2648-40-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2648-41-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 9d08ee470c3b3891b79ecc6f44b83157
SHA1 d53b817bf5185c9b2d41a0f086be835b629099ab
SHA256 f80ebb2ee7861f194b329babab3f8714fddfc45dd79ad4f23a6ec7ee07c2d4eb
SHA512 6c4aa86568628227681a4fea6b17409544812863e234798f7e48688d3034a28c028442b4406f8c3a84e09ed4c53b34aa8995adf80b9908118cd265295e91041a

memory/2648-44-0x0000000000310000-0x0000000000333000-memory.dmp

memory/2648-52-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1272-54-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1272-62-0x0000000000400000-0x0000000000423000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c5b7406345b683aac0518b373cbdd84f
SHA1 0deb562e86650e10b65beee9ba28a992c4a4888f
SHA256 6ee25416e01a90525d076d17facf705c7074660850cb079b47a45e65f8b0649e
SHA512 19ab5be9c66b86a9d4b6fcd5d0182045560ce2fde9dadaf1f1692cfed64a2fc3ae82a3c6a3bab36e44682bc2d6fba04319ed50a1b8a8fc5b738fa9402991c1c6

memory/2744-69-0x0000000000230000-0x0000000000253000-memory.dmp

memory/1528-77-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1528-84-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2072-87-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2072-90-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 11:57

Reported

2024-06-23 12:00

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2684 set thread context of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 1900 set thread context of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2300 set thread context of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4064 set thread context of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\omsecor.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2684 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2684 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2684 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 2684 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe
PID 1276 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1276 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1276 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1160 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1160 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1160 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2300 wrote to memory of 4216 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4216 wrote to memory of 4064 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4064 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4216 wrote to memory of 4064 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4064 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4064 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4064 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4064 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4064 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6a90326eaac24fe7a12d29e3bf5e8140130788716eb6cbd754c35a29c9bb8db6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2684 -ip 2684

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1900 -ip 1900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3048,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2300 -ip 2300

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 296

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4064 -ip 4064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2684-0-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1276-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1276-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1276-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1276-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1900-11-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0b5fee4909cb90d48d71a5c6670417d9
SHA1 00a9058e9d952e07e09c19f45cd37368c22185ad
SHA256 0b74ecbc1fc23ca4830dfd05c4f8fa5bdf452fa4455998d7c387f2657cc60902
SHA512 751b6c7f59993d3647149571bd5aaa7d2bb6a594e567e613643457c8c6add7821e58ab1756bf95a1b89e7a02c467a4fbea47d1dedfe3687a7c181e191cf61f35

memory/1160-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1160-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1900-17-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2684-19-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1160-20-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1160-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1160-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1160-27-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 8e4b9c13b289cb0a0e16ae40f5d29d9a
SHA1 5a85442bb41c6d3e58f4d68b15eda8f5f1eb53b1
SHA256 24c58133e5663b0009d2bd040d7605406811cb9b9ddaf42d9c59b2ede43f3113
SHA512 8fbb13418e1c6e5af15aa2009729295e5f7d07add072071ab3dc6268cfaa9cbc572a58cd5d57799a89b543c96a044d805bbd0e84faf55932227e2815104ecfcb

memory/1160-33-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2300-35-0x0000000000400000-0x0000000000423000-memory.dmp

memory/4216-38-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4216-44-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4216-39-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b44e6363164784df4d99fee58a40ae09
SHA1 fd0e85548ff5a3ab53dcefe7b435ca3c27077359
SHA256 99c2bb9d8e24cb2f1ea68c126a8c1f0751a1385c4aa060e4dd1ef25df1805147
SHA512 202e6432c1b71388beb36fc0d3c8cb0af7b770c9077a692bde7ec939dde39d995a0aab4658eafc5ca0e3d186e8fdd3569d511f54c821eb7763dccb21e6168221

memory/4064-46-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1508-50-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1508-51-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2300-53-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1508-55-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1508-58-0x0000000000400000-0x0000000000429000-memory.dmp