neconyd | 97f556671ec56b8897bd9150654d9f9fb621e73f37cffa505b5be0d2085036fa

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

169170127a7b4ef9367184520bb4319e
SHA1

ee6ac067b51fdb110f30552854f877c4e022ea2f
SHA256

97f556671ec56b8897bd9150654d9f9fb621e73f37cffa505b5be0d2085036fa
SHA512

09854322ff90a4524ccfb73b3ae541d9538d4ca8d1d6779f29ce782b8e0c6353c8f8092084ad4b34e9ab77c905dd3db43e770612dd95907b650ff9d08c298852
SSDEEP

1536:zDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiP:/iRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3908	omsecor.exe
224	omsecor.exe
1480	omsecor.exe
716	omsecor.exe
1664	omsecor.exe
3624	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 3908 set thread context of 224	3908	omsecor.exe	91
PID 1480 set thread context of 716	1480	omsecor.exe	116
PID 1664 set thread context of 3624	1664	omsecor.exe	120

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1096	2536	WerFault.exe	85
4732	3908	WerFault.exe	88
4076	1480	WerFault.exe	115
3956	1664	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 2536 wrote to memory of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 2536 wrote to memory of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 2536 wrote to memory of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 2536 wrote to memory of 244	2536	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	86
PID 244 wrote to memory of 3908	244	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	88
PID 244 wrote to memory of 3908	244	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	88
PID 244 wrote to memory of 3908	244	2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe	88
PID 3908 wrote to memory of 224	3908	omsecor.exe	91
PID 3908 wrote to memory of 224	3908	omsecor.exe	91
PID 3908 wrote to memory of 224	3908	omsecor.exe	91
PID 3908 wrote to memory of 224	3908	omsecor.exe	91
PID 3908 wrote to memory of 224	3908	omsecor.exe	91
PID 224 wrote to memory of 1480	224	omsecor.exe	115
PID 224 wrote to memory of 1480	224	omsecor.exe	115
PID 224 wrote to memory of 1480	224	omsecor.exe	115
PID 1480 wrote to memory of 716	1480	omsecor.exe	116
PID 1480 wrote to memory of 716	1480	omsecor.exe	116
PID 1480 wrote to memory of 716	1480	omsecor.exe	116
PID 1480 wrote to memory of 716	1480	omsecor.exe	116
PID 1480 wrote to memory of 716	1480	omsecor.exe	116
PID 716 wrote to memory of 1664	716	omsecor.exe	118
PID 716 wrote to memory of 1664	716	omsecor.exe	118
PID 716 wrote to memory of 1664	716	omsecor.exe	118
PID 1664 wrote to memory of 3624	1664	omsecor.exe	120
PID 1664 wrote to memory of 3624	1664	omsecor.exe	120
PID 1664 wrote to memory of 3624	1664	omsecor.exe	120
PID 1664 wrote to memory of 3624	1664	omsecor.exe	120
PID 1664 wrote to memory of 3624	1664	omsecor.exe	120

C:\Users\Admin\AppData\Local\Temp\2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_169170127a7b4ef9367184520bb4319e_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 220
        8⤵
        Program crash
        
        PID:3956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 292
        6⤵
        Program crash
        
        PID:4076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 292
      4⤵
      Program crash
      PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 252
  2⤵
  - Program crash
  PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2536 -ip 2536
1⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3908 -ip 3908
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1480 -ip 1480
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1664 -ip 1664
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e4e51a9eee7c6f040d73e1c4665817cd

SHA1
9718528df684aab69a0819d6953b2e2c0da7a00b

SHA256
4d145895595f480aa92a7d53de113b914c38314e82276091a34648b44ea22748

SHA512
246ff23314522462be04ea97951afcdcc1c047327f38be593002be0a647b2314fbbf5dd756d4bd7c45990e82c2189ed7606b76e88c0add4a54377bf947f69c52

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
efd7bbf4716cbcf986d55f8b571134d6

SHA1
f279c8ae07fd21acde62b2cc81b02d5a0ff1b980

SHA256
4bcb78b976028949a789412b80d63c89a38addf8ee215714cfff3363d75556a9

SHA512
cdabdab2307941f66962c236610502be297dcaab4159d04ae357e9aae40e0f55b58e37d98140613a2986cd51bf028f151e6a1ea8dadaf4201a426c44bd6970fc

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
444f10d5908c5f515563396bedbaaf4d

SHA1
b88c9bc1d702ff5d3fcb249fc569bd171de970e3

SHA256
b839730461c2e6be257e2a3c08c30db73df928193941448c9c8484a8868345ed

SHA512
7d0ad5d3d5cd68bcd9333e87cc8b721838573ed0ab5a36d4527ae1df786984a4ab36e37852684ff20e89b0812ead020a01946a13fa66d9b973328ad7abdf26e5

Download Submit
memory/224-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/224-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/244-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/244-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/244-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/244-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/716-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/716-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/716-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1480-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1480-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1664-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2536-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2536-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3624-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3908-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3908-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download