neconyd | 359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

41528258392f55d7580451a0f4f2b5d3
SHA1

7f8a99facb60c29af631d9648f9f9aa48a5b79c6
SHA256

359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9
SHA512

f33d086aeb53ab770a30535dfaa9feb056c99583e055e6670a282586f932aaa863d1579e53bd4a99c23d744eb335faa0416cbdf9a6994b41a5b59d7286379d98
SSDEEP

1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4556	omsecor.exe
4900	omsecor.exe
4584	omsecor.exe
4792	omsecor.exe
4820	omsecor.exe
5228	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5256 set thread context of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 4556 set thread context of 4900	4556	omsecor.exe	89
PID 4584 set thread context of 4792	4584	omsecor.exe	123
PID 4820 set thread context of 5228	4820	omsecor.exe	127

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4832	5256	WerFault.exe	84
5064	4556	WerFault.exe	87
4984	4584	WerFault.exe	122
4556	4820	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5256 wrote to memory of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5256 wrote to memory of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5256 wrote to memory of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5256 wrote to memory of 2476	5256	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	85
PID 2476 wrote to memory of 4556	2476	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 2476 wrote to memory of 4556	2476	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 2476 wrote to memory of 4556	2476	2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe	87
PID 4556 wrote to memory of 4900	4556	omsecor.exe	89
PID 4556 wrote to memory of 4900	4556	omsecor.exe	89
PID 4556 wrote to memory of 4900	4556	omsecor.exe	89
PID 4556 wrote to memory of 4900	4556	omsecor.exe	89
PID 4556 wrote to memory of 4900	4556	omsecor.exe	89
PID 4900 wrote to memory of 4584	4900	omsecor.exe	122
PID 4900 wrote to memory of 4584	4900	omsecor.exe	122
PID 4900 wrote to memory of 4584	4900	omsecor.exe	122
PID 4584 wrote to memory of 4792	4584	omsecor.exe	123
PID 4584 wrote to memory of 4792	4584	omsecor.exe	123
PID 4584 wrote to memory of 4792	4584	omsecor.exe	123
PID 4584 wrote to memory of 4792	4584	omsecor.exe	123
PID 4584 wrote to memory of 4792	4584	omsecor.exe	123
PID 4792 wrote to memory of 4820	4792	omsecor.exe	125
PID 4792 wrote to memory of 4820	4792	omsecor.exe	125
PID 4792 wrote to memory of 4820	4792	omsecor.exe	125
PID 4820 wrote to memory of 5228	4820	omsecor.exe	127
PID 4820 wrote to memory of 5228	4820	omsecor.exe	127
PID 4820 wrote to memory of 5228	4820	omsecor.exe	127
PID 4820 wrote to memory of 5228	4820	omsecor.exe	127
PID 4820 wrote to memory of 5228	4820	omsecor.exe	127

C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 256
        8⤵
        Program crash
        
        PID:4556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 296
        6⤵
        Program crash
        
        PID:4984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 256
      4⤵
      Program crash
      PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 276
  2⤵
  - Program crash
  PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5256 -ip 5256
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4556 -ip 4556
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4584 -ip 4584
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4820 -ip 4820
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
a8efae08cbadf7a2930ee06c2eb2776a

SHA1
e772ffc08d9495dccbaaac34ead657a7cfbe25b9

SHA256
6a7ea6f280c58d36c53201825ba7d4ece80e80a9caaf6fba953d90ff4235dd26

SHA512
37e3334bc554e74fed2763ae6d3329cfc1bfd614737aa6297f00b219d4cd2977b4ed7e6ba5ac05e6fb3ffd7f9a2f1a5b857ea78357836256d43c61ed008500ef

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e2e569327f5a5b67738d50879df035d1

SHA1
0dffa377658c659ebaf1f091a11560b1b7f386e7

SHA256
0caded1c05101a361a9008ffa07b420cc70a2f3eefdb0c3c7483693c011074db

SHA512
06f9a982a86ffd881f19487eb20a88d07397449c887feb9cbaaa615322501c88f16508d4d8398d09ef9e8cecad7c320b70fad293632efaefdc18b1551c66780c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
bfa830323ed9541fea8223eda62ee472

SHA1
b168503e8cce7d0f9368af7af6fcc3c4e8c7fc93

SHA256
3353c9555a4836c6fa1f9e01c37381aa677bf82eba917ef14b913de386648c16

SHA512
07f5e1fb41ed82b26b98e1b916b963e2641a1a6e85dcd5bfe2268c8112cdf0c9c07eeaac9b139675a31018a470b6033d4aa4304485b6edc39eca7df046b5e472

Download Submit
memory/2476-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2476-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2476-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2476-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4556-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4584-48-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4584-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4792-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4792-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4792-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4820-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4820-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4900-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5228-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5228-46-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5228-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5228-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5256-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5256-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download