neconyd | c9a66c51d5b520d1597e65641c8edc205d68d133432e75c8248a1871b332c23d

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

cff9fc8aa25c64c8c64210e0e69d8594
SHA1

b8354fd545725c8da9f3a7026c59a58f4b3420de
SHA256

c9a66c51d5b520d1597e65641c8edc205d68d133432e75c8248a1871b332c23d
SHA512

49308d4151cbabeb576c68f1455fc7afd43349046ecf88a23c6a55a0e981c66f2b807e48703b785ae72eb301506eb5412e5ceab07b2c0e7653d90bea70c9105a
SSDEEP

1536:qDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiV:MiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4296	omsecor.exe
2868	omsecor.exe
3676	omsecor.exe
5124	omsecor.exe
4232	omsecor.exe
3120	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 4296 set thread context of 2868	4296	omsecor.exe	90
PID 3676 set thread context of 5124	3676	omsecor.exe	114
PID 4232 set thread context of 3120	4232	omsecor.exe	118

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5544	4296	WerFault.exe	88
4120	2612	WerFault.exe	84
3996	3676	WerFault.exe	113
2324	4232	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 2612 wrote to memory of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 2612 wrote to memory of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 2612 wrote to memory of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 2612 wrote to memory of 5632	2612	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	85
PID 5632 wrote to memory of 4296	5632	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	88
PID 5632 wrote to memory of 4296	5632	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	88
PID 5632 wrote to memory of 4296	5632	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	88
PID 4296 wrote to memory of 2868	4296	omsecor.exe	90
PID 4296 wrote to memory of 2868	4296	omsecor.exe	90
PID 4296 wrote to memory of 2868	4296	omsecor.exe	90
PID 4296 wrote to memory of 2868	4296	omsecor.exe	90
PID 4296 wrote to memory of 2868	4296	omsecor.exe	90
PID 2868 wrote to memory of 3676	2868	omsecor.exe	113
PID 2868 wrote to memory of 3676	2868	omsecor.exe	113
PID 2868 wrote to memory of 3676	2868	omsecor.exe	113
PID 3676 wrote to memory of 5124	3676	omsecor.exe	114
PID 3676 wrote to memory of 5124	3676	omsecor.exe	114
PID 3676 wrote to memory of 5124	3676	omsecor.exe	114
PID 3676 wrote to memory of 5124	3676	omsecor.exe	114
PID 3676 wrote to memory of 5124	3676	omsecor.exe	114
PID 5124 wrote to memory of 4232	5124	omsecor.exe	116
PID 5124 wrote to memory of 4232	5124	omsecor.exe	116
PID 5124 wrote to memory of 4232	5124	omsecor.exe	116
PID 4232 wrote to memory of 3120	4232	omsecor.exe	118
PID 4232 wrote to memory of 3120	4232	omsecor.exe	118
PID 4232 wrote to memory of 3120	4232	omsecor.exe	118
PID 4232 wrote to memory of 3120	4232	omsecor.exe	118
PID 4232 wrote to memory of 3120	4232	omsecor.exe	118

C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3676
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 256
        8⤵
        Program crash
        
        PID:2324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 300
        6⤵
        Program crash
        
        PID:3996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 276
      4⤵
      Program crash
      PID:5544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 288
  2⤵
  - Program crash
  PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2612 -ip 2612
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4296 -ip 4296
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3676 -ip 3676
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4232 -ip 4232
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
33449e8b2df5902c41d9c3a2271dab3f

SHA1
30343e7ab86aa1561608480c504061f24ce2fdf0

SHA256
4a8cc9bbb19b442058b343a716cb2c129226301d8b235520cbec50ec408dd85c

SHA512
c51963226c481a3b545a08c43cb133cbe183e39cd2a31a026f2baa4fc31744505724eaaaa1b7493f90ed6485d73652e932a597ec8c2a1052b687a0f401be2b06

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
1eb057177aaa9c1a428d45f47d3a3991

SHA1
976b1414f5bca9eea8fdd71785f1daa9cb22522e

SHA256
a4c7af728000933e5a9716784482e5a28150c32442ae5d9aebc4cd8e4ae5756d

SHA512
919466ddfbdf5429b723a0caf880a806a7c4f0e5af4982ace31958a3a0ca6daf797c0af4ee2fa317c04d6f8d7722015183f78e78ed062a2882e4c352005bb32a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
3900a49e02248dffecc4830a7cf81a30

SHA1
4d0f0fbfa4abe034a47115cec1c14da2e54c69e3

SHA256
a77bad3f81a6fbdcabe8d496e9f1a4c1c68262a84b81442683657437f7e1785e

SHA512
4cd938539a22d1e6bed081029580f1854854dc2413b1e68bef10a39f2a0f77e89ba7602abde506180e50278478cef8b0b4fde4bb70aae3073a420e8b8d405a1c

Download Submit
memory/2612-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2612-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2868-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2868-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3120-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3120-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3120-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3120-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3676-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3676-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4232-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4296-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4296-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5124-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5124-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5124-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5632-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5632-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5632-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5632-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download