neconyd | c9a66c51d5b520d1597e65641c8edc205d68d133432e75c8248a1871b332c23d

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

cff9fc8aa25c64c8c64210e0e69d8594
SHA1

b8354fd545725c8da9f3a7026c59a58f4b3420de
SHA256

c9a66c51d5b520d1597e65641c8edc205d68d133432e75c8248a1871b332c23d
SHA512

49308d4151cbabeb576c68f1455fc7afd43349046ecf88a23c6a55a0e981c66f2b807e48703b785ae72eb301506eb5412e5ceab07b2c0e7653d90bea70c9105a
SSDEEP

1536:qDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiV:MiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1576	omsecor.exe
3844	omsecor.exe
5352	omsecor.exe
5604	omsecor.exe
6136	omsecor.exe
2256	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5792 set thread context of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 1576 set thread context of 3844	1576	omsecor.exe	93
PID 5352 set thread context of 5604	5352	omsecor.exe	122
PID 6136 set thread context of 2256	6136	omsecor.exe	126

Program crash 4 IoCs

pid	pid_target	Process	procid_target
772	5792	WerFault.exe	88
4188	1576	WerFault.exe	91
6084	5352	WerFault.exe	121
3044	6136	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 5792 wrote to memory of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 5792 wrote to memory of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 5792 wrote to memory of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 5792 wrote to memory of 5048	5792	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	89
PID 5048 wrote to memory of 1576	5048	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	91
PID 5048 wrote to memory of 1576	5048	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	91
PID 5048 wrote to memory of 1576	5048	2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe	91
PID 1576 wrote to memory of 3844	1576	omsecor.exe	93
PID 1576 wrote to memory of 3844	1576	omsecor.exe	93
PID 1576 wrote to memory of 3844	1576	omsecor.exe	93
PID 1576 wrote to memory of 3844	1576	omsecor.exe	93
PID 1576 wrote to memory of 3844	1576	omsecor.exe	93
PID 3844 wrote to memory of 5352	3844	omsecor.exe	121
PID 3844 wrote to memory of 5352	3844	omsecor.exe	121
PID 3844 wrote to memory of 5352	3844	omsecor.exe	121
PID 5352 wrote to memory of 5604	5352	omsecor.exe	122
PID 5352 wrote to memory of 5604	5352	omsecor.exe	122
PID 5352 wrote to memory of 5604	5352	omsecor.exe	122
PID 5352 wrote to memory of 5604	5352	omsecor.exe	122
PID 5352 wrote to memory of 5604	5352	omsecor.exe	122
PID 5604 wrote to memory of 6136	5604	omsecor.exe	124
PID 5604 wrote to memory of 6136	5604	omsecor.exe	124
PID 5604 wrote to memory of 6136	5604	omsecor.exe	124
PID 6136 wrote to memory of 2256	6136	omsecor.exe	126
PID 6136 wrote to memory of 2256	6136	omsecor.exe	126
PID 6136 wrote to memory of 2256	6136	omsecor.exe	126
PID 6136 wrote to memory of 2256	6136	omsecor.exe	126
PID 6136 wrote to memory of 2256	6136	omsecor.exe	126

C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_cff9fc8aa25c64c8c64210e0e69d8594_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3844
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5352
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 256
        8⤵
        Program crash
        
        PID:3044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 292
        6⤵
        Program crash
        
        PID:6084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 288
      4⤵
      Program crash
      PID:4188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 288
  2⤵
  - Program crash
  PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5792 -ip 5792
1⤵
PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1576 -ip 1576
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5352 -ip 5352
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6136 -ip 6136
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
69cd69bf70efb1b6715533f76438bc4b

SHA1
d8d98d17d3e37a3af384a90736149eea5f6ebade

SHA256
5418c34a036eccc18d88d2883872f0b549a346f3e0444797f95a8f2ef72a076f

SHA512
0cccfba659dc18b78a38396b6dd1b063ae476a47eabf58f62c35dd13d5656e39e7a1c03a6433431c08a2c0aad3fd425e7031afe20aadcd938469532cfdd33a2b

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
1eb057177aaa9c1a428d45f47d3a3991

SHA1
976b1414f5bca9eea8fdd71785f1daa9cb22522e

SHA256
a4c7af728000933e5a9716784482e5a28150c32442ae5d9aebc4cd8e4ae5756d

SHA512
919466ddfbdf5429b723a0caf880a806a7c4f0e5af4982ace31958a3a0ca6daf797c0af4ee2fa317c04d6f8d7722015183f78e78ed062a2882e4c352005bb32a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
33449e8b2df5902c41d9c3a2271dab3f

SHA1
30343e7ab86aa1561608480c504061f24ce2fdf0

SHA256
4a8cc9bbb19b442058b343a716cb2c129226301d8b235520cbec50ec408dd85c

SHA512
c51963226c481a3b545a08c43cb133cbe183e39cd2a31a026f2baa4fc31744505724eaaaa1b7493f90ed6485d73652e932a597ec8c2a1052b687a0f401be2b06

Download Submit
memory/1576-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1576-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2256-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2256-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2256-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2256-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5048-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5048-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5048-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5048-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5352-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5352-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5604-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5604-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5604-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5792-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5792-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6136-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6136-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download