neconyd | 3766d62b23c594db67a171d7d8b276ee82f9d64fea7d98f7e65b9b8e179dedbf

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

b4cf099006761ced4130334ae8ef0f2a
SHA1

0b2ce9a9958243479819f8580e8fbc9fb729cadd
SHA256

3766d62b23c594db67a171d7d8b276ee82f9d64fea7d98f7e65b9b8e179dedbf
SHA512

3c12bc2aff13da4839464c2b0c463dc21d1dfeee581366828ff986256672b713df5ce31efa0d86289a2e205c477d9e59b38ffaf73c25e2cfcaf2a0e5e2e1ae2e
SSDEEP

1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1940	omsecor.exe
1156	omsecor.exe
4536	omsecor.exe
436	omsecor.exe
800	omsecor.exe
5640	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5180 set thread context of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 1940 set thread context of 1156	1940	omsecor.exe	90
PID 4536 set thread context of 436	4536	omsecor.exe	116
PID 800 set thread context of 5640	800	omsecor.exe	119

Program crash 4 IoCs

pid	pid_target	Process	procid_target
364	5180	WerFault.exe	85
5428	1940	WerFault.exe	89
5664	4536	WerFault.exe	115
5464	800	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 5180 wrote to memory of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 5180 wrote to memory of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 5180 wrote to memory of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 5180 wrote to memory of 3076	5180	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	86
PID 3076 wrote to memory of 1940	3076	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	89
PID 3076 wrote to memory of 1940	3076	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	89
PID 3076 wrote to memory of 1940	3076	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	89
PID 1940 wrote to memory of 1156	1940	omsecor.exe	90
PID 1940 wrote to memory of 1156	1940	omsecor.exe	90
PID 1940 wrote to memory of 1156	1940	omsecor.exe	90
PID 1940 wrote to memory of 1156	1940	omsecor.exe	90
PID 1940 wrote to memory of 1156	1940	omsecor.exe	90
PID 1156 wrote to memory of 4536	1156	omsecor.exe	115
PID 1156 wrote to memory of 4536	1156	omsecor.exe	115
PID 1156 wrote to memory of 4536	1156	omsecor.exe	115
PID 4536 wrote to memory of 436	4536	omsecor.exe	116
PID 4536 wrote to memory of 436	4536	omsecor.exe	116
PID 4536 wrote to memory of 436	4536	omsecor.exe	116
PID 4536 wrote to memory of 436	4536	omsecor.exe	116
PID 4536 wrote to memory of 436	4536	omsecor.exe	116
PID 436 wrote to memory of 800	436	omsecor.exe	118
PID 436 wrote to memory of 800	436	omsecor.exe	118
PID 436 wrote to memory of 800	436	omsecor.exe	118
PID 800 wrote to memory of 5640	800	omsecor.exe	119
PID 800 wrote to memory of 5640	800	omsecor.exe	119
PID 800 wrote to memory of 5640	800	omsecor.exe	119
PID 800 wrote to memory of 5640	800	omsecor.exe	119
PID 800 wrote to memory of 5640	800	omsecor.exe	119

C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:800
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 256
        8⤵
        Program crash
        
        PID:5464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 296
        6⤵
        Program crash
        
        PID:5664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 288
      4⤵
      Program crash
      PID:5428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 292
  2⤵
  - Program crash
  PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5180 -ip 5180
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1940 -ip 1940
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4536 -ip 4536
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 800 -ip 800
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
d532701630b7f773734cb8961706e905

SHA1
f61428d9ea692f65dc1391d4980ce43cec9ea15e

SHA256
9ea8a9381e46abd4161024d63c9f54750b89cb7b254ff1250611233906c8087f

SHA512
02660a1157f22f9f416d764527d78a976802a9343430b6a47c7f1e186de9cca79d42cedc4d5d5bc2883e9bd858900c0ff25e2722a634aa4182365bd9bd597f11

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
dc7a833f8a7f035ca0e2b6359ceea716

SHA1
43382e06877f25067b3068528fbd36a73b7b68ce

SHA256
3b36344499f87e3e74f4ac3d2d03527d2fc3cec061c24534577dbfedbaa72948

SHA512
5d7818ea02cfa759a2478af427e9614d0e13c41e56a7bb7a255b6197798c42518ab98a56767efbc15fbd9dbca094d382aac8353b0f17e06e2b28278a5935a7b4

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
5a6cbdbea3275a2a07cbd68cf45a0eee

SHA1
af4c27b9fe98a1fa6a6fb3c16e3999861b511541

SHA256
5d0c0c1ddb824f74f8568d1b8c3b2da3a493e6f9afc286d90e102884bea55a7a

SHA512
e7cca79a806a58333e4823923795237e35befa1f4fcfb8e132e45e766cb9b5f3255244f1389e97cfcbe5a7bf79af6d6ae1534bb512969f8f2b4aa5907488f0e5

Download Submit
memory/436-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/800-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1156-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1156-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1940-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1940-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3076-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4536-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4536-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5180-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5180-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5640-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5640-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5640-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5640-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download