neconyd | 359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

41528258392f55d7580451a0f4f2b5d3
SHA1

7f8a99facb60c29af631d9648f9f9aa48a5b79c6
SHA256

359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9
SHA512

f33d086aeb53ab770a30535dfaa9feb056c99583e055e6670a282586f932aaa863d1579e53bd4a99c23d744eb335faa0416cbdf9a6994b41a5b59d7286379d98
SSDEEP

1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery persistence trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Executes dropped EXE 6 IoCs

pid	Process
3388	omsecor.exe
4928	omsecor.exe
2636	omsecor.exe
736	omsecor.exe
1196	omsecor.exe
872	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 3388 set thread context of 4928	3388	omsecor.exe	92
PID 2636 set thread context of 736	2636	omsecor.exe	117
PID 1196 set thread context of 872	1196	omsecor.exe	121

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2704	1188	WerFault.exe	84
4600	3388	WerFault.exe	90
2496	2636	WerFault.exe	116
2260	1196	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 1188 wrote to memory of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 1188 wrote to memory of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 1188 wrote to memory of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 1188 wrote to memory of 2944	1188	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 2944 wrote to memory of 3388	2944	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	90
PID 2944 wrote to memory of 3388	2944	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	90
PID 2944 wrote to memory of 3388	2944	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	90
PID 3388 wrote to memory of 4928	3388	omsecor.exe	92
PID 3388 wrote to memory of 4928	3388	omsecor.exe	92
PID 3388 wrote to memory of 4928	3388	omsecor.exe	92
PID 3388 wrote to memory of 4928	3388	omsecor.exe	92
PID 3388 wrote to memory of 4928	3388	omsecor.exe	92
PID 4928 wrote to memory of 2636	4928	omsecor.exe	116
PID 4928 wrote to memory of 2636	4928	omsecor.exe	116
PID 4928 wrote to memory of 2636	4928	omsecor.exe	116
PID 2636 wrote to memory of 736	2636	omsecor.exe	117
PID 2636 wrote to memory of 736	2636	omsecor.exe	117
PID 2636 wrote to memory of 736	2636	omsecor.exe	117
PID 2636 wrote to memory of 736	2636	omsecor.exe	117
PID 2636 wrote to memory of 736	2636	omsecor.exe	117
PID 736 wrote to memory of 1196	736	omsecor.exe	119
PID 736 wrote to memory of 1196	736	omsecor.exe	119
PID 736 wrote to memory of 1196	736	omsecor.exe	119
PID 1196 wrote to memory of 872	1196	omsecor.exe	121
PID 1196 wrote to memory of 872	1196	omsecor.exe	121
PID 1196 wrote to memory of 872	1196	omsecor.exe	121
PID 1196 wrote to memory of 872	1196	omsecor.exe	121
PID 1196 wrote to memory of 872	1196	omsecor.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 268
        8⤵
        Program crash
        
        PID:2260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 292
        6⤵
        Program crash
        
        PID:2496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 288
      4⤵
      Program crash
      PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 288
  2⤵
  - Program crash
  PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1188 -ip 1188
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3388 -ip 3388
1⤵
PID:620

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe be7269c89b78be457aff0b5ad2074f8e xZDhZDmZw0GylCk5MS7/YQ.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2636 -ip 2636
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1196 -ip 1196
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
629f860fd54f4a28de6803a93016f5a3

SHA1
0c2ac2af1b9a387f441fa78a55c385b582896d40

SHA256
d6da7a62acd00ea140a643cf32fa76d185a3e431312e001e77f0d7fe882d3d91

SHA512
67475d9f8d3c1302556d6424bc9eda7476c0d3550e17e3888ff71fd335fb03fde6bcb656e453518d56ffb1a39f79aca32d5ff6be22354b1a1bba825429879e83

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e2e569327f5a5b67738d50879df035d1

SHA1
0dffa377658c659ebaf1f091a11560b1b7f386e7

SHA256
0caded1c05101a361a9008ffa07b420cc70a2f3eefdb0c3c7483693c011074db

SHA512
06f9a982a86ffd881f19487eb20a88d07397449c887feb9cbaaa615322501c88f16508d4d8398d09ef9e8cecad7c320b70fad293632efaefdc18b1551c66780c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
a0d26c479579e7512e0c9dba8b057368

SHA1
4feca38f396652f3ba96074a604cc06a37f6e55e

SHA256
5db15c4284a73bbee6cca03085a87b02bc7377fc92bf11bf52710bc4b856afcd

SHA512
bd99753c02187b2dd380026f51a0a98136a9f48960a927a9a99acd6d101ed6ee247eb74c822dfa7150d0d451aa2032a9b34d2aa5226948878dc6a9d333067000

Download Submit
memory/736-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/736-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/736-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/872-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/872-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/872-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1188-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1188-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1196-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2636-48-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2636-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2944-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2944-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2944-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2944-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3388-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3388-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4928-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads