Malware Analysis Report

2024-11-16 12:58

Sample ID 240818-hpesba1fra
Target 43f1333d880fc73b01ecd2d0ebbd3370N.exe
SHA256 dc6e701613bc61254f3f02b3e584e7462444789940d3727280086a8cebeef89a
Tags
neconyd discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc6e701613bc61254f3f02b3e584e7462444789940d3727280086a8cebeef89a

Threat Level: Known bad

The file 43f1333d880fc73b01ecd2d0ebbd3370N.exe was found to be: Known bad.

Malicious Activity Summary

neconyd discovery trojan

Neconyd

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in System32 directory

System Location Discovery: System Language Discovery

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 06:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 06:54

Reported

2024-08-18 06:56

Platform

win7-20240705-en

Max time kernel

114s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"

Signatures

Neconyd

trojan neconyd

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2852 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 2080 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2080 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2080 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2080 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2816 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2636 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2636 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2636 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2636 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2748 wrote to memory of 2212 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2212 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 1624 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1624 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/2852-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2080-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2080-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2852-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2080-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2080-8-0x0000000000400000-0x0000000000429000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 3d7b5d84e8b2c05e47f7240af033ee95
SHA1 828a693d9127233cf978d1b9a42a4ae2c04f2ea3
SHA256 584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86
SHA512 a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba

memory/2816-28-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2816-20-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2080-18-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2636-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2636-36-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2636-42-0x0000000000400000-0x0000000000429000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 be9bc9eea78cda6b10e7400ed99361fa
SHA1 c0eaa7e16583dd1fcfe5dbfd309a151f6f9f84b6
SHA256 3811e03cce1b96e5061d04a293fcb09025f649cc8f5861d69d289e46bb2f2d95
SHA512 64d5361696a17e3d21e24d2562863f9c24fdeaed273b6c9d1ada1a3881f39157ec7747b612d53eed04b754e4758714e60b6749536e46ea0d735d96454b0881e5

memory/2636-45-0x0000000000350000-0x0000000000374000-memory.dmp

memory/2748-55-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2748-64-0x0000000000400000-0x0000000000424000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7d8439ccdf11d7e851ecdf1ce441ab4e
SHA1 d52ac78f5d1e1b09001d3293b9819bb9cd0137b0
SHA256 1d50b988ce6eb0cc36c7a5efc716a9eb99bbc49c33499ca89f05e7f960e3e464
SHA512 7912b77eba9e1bd387d3e45cb278545fef0d9b63ea3cd22581caf1ddd06e19b352f78c1ed98125b7dcc8f41f1be168f3e3ccf4ab2f295592a2e2fa03f6c6aa9b

memory/1624-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1624-84-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2636-85-0x0000000000350000-0x0000000000374000-memory.dmp

memory/2036-86-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 06:54

Reported

2024-08-18 06:56

Platform

win10v2004-20240802-en

Max time kernel

116s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"

Signatures

Neconyd

trojan neconyd

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1116 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 1116 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 1116 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 1116 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 1116 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe
PID 3916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2712 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3272 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3272 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3272 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 4692 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 4692 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 4692 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 4692 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 4692 N/A C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4692 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4692 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4692 wrote to memory of 2764 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2764 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

"C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe"

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

C:\Users\Admin\AppData\Local\Temp\43f1333d880fc73b01ecd2d0ebbd3370N.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1116 -ip 1116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 288

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2712 -ip 2712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 288

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1944 -ip 1944

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2764 -ip 2764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
FI 193.166.255.171:80 lousta.net tcp

Files

memory/1116-0-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3916-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3916-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3916-3-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 3d7b5d84e8b2c05e47f7240af033ee95
SHA1 828a693d9127233cf978d1b9a42a4ae2c04f2ea3
SHA256 584d5fec78e14082ecd0f8ec1c823265c088d6bdaf66fb3bd6f2c3eb88937d86
SHA512 a113268f1ae48eb99df56335e2688c3b1fcb20d05bad4831c85e0fba5d7addfd96db3364a3c8a6e3ba33127709f4e4e3ba3dd0b5ff67f5674690396eb21de8ba

memory/2712-9-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3916-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-14-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2712-17-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1116-18-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3272-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-26-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3272-30-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 79e9a8fb680fe7636871e4bbfdb83f05
SHA1 bef4d34e0bedccd1cb7ff929581d4403cf9d4154
SHA256 d449ed7d9735c38a6aa75a5729f148bd221200ca81be336f19a5442f38b66c7f
SHA512 21254d90ee39ec3248d8b19238b91fa2c9141578372d602641786dddc2b7801422847dc412632aaa5b2485d50bfd03ae1eaa6cc0e67e531f6d426b4a98f3186a

memory/1944-31-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4692-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4692-36-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 13c0f95243bc1d501f9b8eec370f5942
SHA1 0946eb0c861e715407cc767dd547a82312edb279
SHA256 f3b26927e40f90459a78c25d9facea12ab8ba425738bafbeec685544df6f6071
SHA512 f09a5e959f171205747f551e51f859027ebb5177138b89041db54208bf0749a94a9c5a52cdc46266422bb5fc68158b3bcd13d9a64f5a0040624a8c62dc057edb

memory/4692-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1832-48-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1832-49-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2764-44-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1944-50-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2764-51-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1832-52-0x0000000000400000-0x0000000000429000-memory.dmp