neconyd | 3766d62b23c594db67a171d7d8b276ee82f9d64fea7d98f7e65b9b8e179dedbf

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

b4cf099006761ced4130334ae8ef0f2a
SHA1

0b2ce9a9958243479819f8580e8fbc9fb729cadd
SHA256

3766d62b23c594db67a171d7d8b276ee82f9d64fea7d98f7e65b9b8e179dedbf
SHA512

3c12bc2aff13da4839464c2b0c463dc21d1dfeee581366828ff986256672b713df5ce31efa0d86289a2e205c477d9e59b38ffaf73c25e2cfcaf2a0e5e2e1ae2e
SSDEEP

1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4536	omsecor.exe
4240	omsecor.exe
1572	omsecor.exe
3624	omsecor.exe
444	omsecor.exe
2040	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 6132 set thread context of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 4536 set thread context of 4240	4536	omsecor.exe	90
PID 1572 set thread context of 3624	1572	omsecor.exe	110
PID 444 set thread context of 2040	444	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5964	6132	WerFault.exe	84
5596	4536	WerFault.exe	88
2392	1572	WerFault.exe	109
3408	444	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 6132 wrote to memory of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 6132 wrote to memory of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 6132 wrote to memory of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 6132 wrote to memory of 5844	6132	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	85
PID 5844 wrote to memory of 4536	5844	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	88
PID 5844 wrote to memory of 4536	5844	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	88
PID 5844 wrote to memory of 4536	5844	2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe	88
PID 4536 wrote to memory of 4240	4536	omsecor.exe	90
PID 4536 wrote to memory of 4240	4536	omsecor.exe	90
PID 4536 wrote to memory of 4240	4536	omsecor.exe	90
PID 4536 wrote to memory of 4240	4536	omsecor.exe	90
PID 4536 wrote to memory of 4240	4536	omsecor.exe	90
PID 4240 wrote to memory of 1572	4240	omsecor.exe	109
PID 4240 wrote to memory of 1572	4240	omsecor.exe	109
PID 4240 wrote to memory of 1572	4240	omsecor.exe	109
PID 1572 wrote to memory of 3624	1572	omsecor.exe	110
PID 1572 wrote to memory of 3624	1572	omsecor.exe	110
PID 1572 wrote to memory of 3624	1572	omsecor.exe	110
PID 1572 wrote to memory of 3624	1572	omsecor.exe	110
PID 1572 wrote to memory of 3624	1572	omsecor.exe	110
PID 3624 wrote to memory of 444	3624	omsecor.exe	112
PID 3624 wrote to memory of 444	3624	omsecor.exe	112
PID 3624 wrote to memory of 444	3624	omsecor.exe	112
PID 444 wrote to memory of 2040	444	omsecor.exe	114
PID 444 wrote to memory of 2040	444	omsecor.exe	114
PID 444 wrote to memory of 2040	444	omsecor.exe	114
PID 444 wrote to memory of 2040	444	omsecor.exe	114
PID 444 wrote to memory of 2040	444	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_b4cf099006761ced4130334ae8ef0f2a_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1572
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 256
        8⤵
        Program crash
        
        PID:3408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 292
        6⤵
        Program crash
        
        PID:2392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 288
      4⤵
      Program crash
      PID:5596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 288
  2⤵
  - Program crash
  PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6132 -ip 6132
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4536 -ip 4536
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1572 -ip 1572
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 444 -ip 444
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
d4d28fd5ffde77813be4a4f758ed7f7c

SHA1
d25a8551f434bd1b4d1400ac62581f7ab81034be

SHA256
e1db5ee3c31dbfc95cf20eeca7e76bb2de1e73176f15bd0b1cc1987f1bc86aae

SHA512
0f315d84ec79317e9965600a055c67ba62c27bec3209da02f636fa3c0112d9e6c6eec80f5b75abfc03ec706ee5aa8a15220fa7a5a8b2fc8ac58929ae04acfbc5

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
dc7a833f8a7f035ca0e2b6359ceea716

SHA1
43382e06877f25067b3068528fbd36a73b7b68ce

SHA256
3b36344499f87e3e74f4ac3d2d03527d2fc3cec061c24534577dbfedbaa72948

SHA512
5d7818ea02cfa759a2478af427e9614d0e13c41e56a7bb7a255b6197798c42518ab98a56767efbc15fbd9dbca094d382aac8353b0f17e06e2b28278a5935a7b4

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
5e90ccbf0463d8810711e34899280157

SHA1
7f6c0d7d4f14361bb1784e97448d94bdff6a89ec

SHA256
a1f24cd693443be5f5488c9450758eadc82fdd7a8a1d271f08876fd61a2ddc83

SHA512
30dd901329eb010a7d0a62d32f31950848b2937dc72ede7bed1316461b3ba5a157b2c406575a7e1ec90cb5ef6d961f6eb44f9d18db8737f40e54b322ca74040c

Download Submit
memory/444-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1572-33-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1572-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4240-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4536-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4536-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5844-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5844-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5844-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5844-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6132-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6132-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download