neconyd | 9e5d0b4d9a74596c8a889636ac15ce9ee9676ef31763a386a87dcd157d27b192

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

af7d95e8118747840cfb89b9dee4d8fb
SHA1

048a3ae8c2dfc4791790b7c8e8a12e70d4799f27
SHA256

9e5d0b4d9a74596c8a889636ac15ce9ee9676ef31763a386a87dcd157d27b192
SHA512

1589defae353da65e6ac3c476aebd36fc255785bd1618051c77587ac1efe4ac66d507a37ef33d0ae5a64c7348aed5d63fab9ed5bbc84b557c5de3be43243c8fe
SSDEEP

1536:JDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiY:5iRTeH0iqAW6J6f1tqF6dngNmaZCiaJ

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
5388	omsecor.exe
524	omsecor.exe
1748	omsecor.exe
3404	omsecor.exe
3108	omsecor.exe
2828	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 5388 set thread context of 524	5388	omsecor.exe	89
PID 1748 set thread context of 3404	1748	omsecor.exe	114
PID 3108 set thread context of 2828	3108	omsecor.exe	118

Program crash 4 IoCs

pid	pid_target	Process	procid_target
220	5388	WerFault.exe	88
5108	2016	WerFault.exe	84
5676	1748	WerFault.exe	113
2776	3108	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 2016 wrote to memory of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 2016 wrote to memory of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 2016 wrote to memory of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 2016 wrote to memory of 5764	2016	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	85
PID 5764 wrote to memory of 5388	5764	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	88
PID 5764 wrote to memory of 5388	5764	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	88
PID 5764 wrote to memory of 5388	5764	2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe	88
PID 5388 wrote to memory of 524	5388	omsecor.exe	89
PID 5388 wrote to memory of 524	5388	omsecor.exe	89
PID 5388 wrote to memory of 524	5388	omsecor.exe	89
PID 5388 wrote to memory of 524	5388	omsecor.exe	89
PID 5388 wrote to memory of 524	5388	omsecor.exe	89
PID 524 wrote to memory of 1748	524	omsecor.exe	113
PID 524 wrote to memory of 1748	524	omsecor.exe	113
PID 524 wrote to memory of 1748	524	omsecor.exe	113
PID 1748 wrote to memory of 3404	1748	omsecor.exe	114
PID 1748 wrote to memory of 3404	1748	omsecor.exe	114
PID 1748 wrote to memory of 3404	1748	omsecor.exe	114
PID 1748 wrote to memory of 3404	1748	omsecor.exe	114
PID 1748 wrote to memory of 3404	1748	omsecor.exe	114
PID 3404 wrote to memory of 3108	3404	omsecor.exe	116
PID 3404 wrote to memory of 3108	3404	omsecor.exe	116
PID 3404 wrote to memory of 3108	3404	omsecor.exe	116
PID 3108 wrote to memory of 2828	3108	omsecor.exe	118
PID 3108 wrote to memory of 2828	3108	omsecor.exe	118
PID 3108 wrote to memory of 2828	3108	omsecor.exe	118
PID 3108 wrote to memory of 2828	3108	omsecor.exe	118
PID 3108 wrote to memory of 2828	3108	omsecor.exe	118

C:\Users\Admin\AppData\Local\Temp\2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_af7d95e8118747840cfb89b9dee4d8fb_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:524
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 256
        8⤵
        Program crash
        
        PID:2776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 292
        6⤵
        Program crash
        
        PID:5676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 288
      4⤵
      Program crash
      PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 300
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2016 -ip 2016
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5388 -ip 5388
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1748 -ip 1748
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3108 -ip 3108
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
43e27b3c2cf01e665878d34f7139235c

SHA1
0fca96b3a6ce85aee2154dd22936910c6775c83d

SHA256
157a53b682aa3c188775d90af1358c778cc1c6bed978b53efdf5c03a0f8145de

SHA512
7cbcf364483aa370a56bdab49d19c40fc1fad9e7770d5ab1a51846d8ed161c1d9e4540cf3dbfed313dd87253511c7b3c1e3edc82748978e4ffd73da5b8baba9d

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
9bfe93c19e4db22eb4a47099cc552372

SHA1
dc7a31ec5b3cfc0a7f596815a2a6e271fd8712e0

SHA256
0d3256200d4c40350bf8ef65471e06895119e67de375e915b12864d67edaecca

SHA512
51b0341bddeb2729f52d751a167006ebe86a6cf3e3df0ea8f2ade48b541d5dea06ff16a326704108feb8c6f57c5601a623d903ee08efa11878d55fff42241a5c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
ba5734b7d95c7618d901e47e75b5d591

SHA1
68f4e8db56744bc2531f95a22f6ee9cfcf6433e3

SHA256
2651562799faaaa8cb5a7d9b6a92ddcf6c828f6ce7e1636a9db1f915513f6106

SHA512
15043df136785dda22d0527e1f60f8b72003c9b29ed767bb9681470e129c7769dd51f7dbea9cc1538ca5e39e90b8e9d90b0f6eae689266e969526c8ca854ef57

Download Submit
memory/524-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/524-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1748-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1748-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2016-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2016-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2828-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3108-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3404-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3404-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3404-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5388-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5388-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5764-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5764-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5764-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5764-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download