neconyd | 8030baff2641e9129651195963fcf581932762689ced6623b3ede223ce52bed4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

95c55ca881eaad2bd0cc78e2397db250
SHA1

60c91ef6bb168076252180eaa0d03de2fccbbb52
SHA256

8030baff2641e9129651195963fcf581932762689ced6623b3ede223ce52bed4
SHA512

d8af069b2993b36563f04cc67f0181fe7600b629627a1ce8f168fff32a19660b78b2b5c827d40194cb8fe3e647f51a2b840bb68e7b9079998aad98a901c5b7ec
SSDEEP

1536:ADfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:2iRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4332	omsecor.exe
1104	omsecor.exe
2436	omsecor.exe
212	omsecor.exe
4488	omsecor.exe
4124	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4332 set thread context of 1104	4332	omsecor.exe	89
PID 2436 set thread context of 212	2436	omsecor.exe	115
PID 4488 set thread context of 4124	4488	omsecor.exe	119

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1408	4764	WerFault.exe	84
4484	4332	WerFault.exe	87
3456	2436	WerFault.exe	114
4460	4488	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4764 wrote to memory of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4764 wrote to memory of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4764 wrote to memory of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4764 wrote to memory of 4636	4764	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	85
PID 4636 wrote to memory of 4332	4636	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	87
PID 4636 wrote to memory of 4332	4636	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	87
PID 4636 wrote to memory of 4332	4636	2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe	87
PID 4332 wrote to memory of 1104	4332	omsecor.exe	89
PID 4332 wrote to memory of 1104	4332	omsecor.exe	89
PID 4332 wrote to memory of 1104	4332	omsecor.exe	89
PID 4332 wrote to memory of 1104	4332	omsecor.exe	89
PID 4332 wrote to memory of 1104	4332	omsecor.exe	89
PID 1104 wrote to memory of 2436	1104	omsecor.exe	114
PID 1104 wrote to memory of 2436	1104	omsecor.exe	114
PID 1104 wrote to memory of 2436	1104	omsecor.exe	114
PID 2436 wrote to memory of 212	2436	omsecor.exe	115
PID 2436 wrote to memory of 212	2436	omsecor.exe	115
PID 2436 wrote to memory of 212	2436	omsecor.exe	115
PID 2436 wrote to memory of 212	2436	omsecor.exe	115
PID 2436 wrote to memory of 212	2436	omsecor.exe	115
PID 212 wrote to memory of 4488	212	omsecor.exe	117
PID 212 wrote to memory of 4488	212	omsecor.exe	117
PID 212 wrote to memory of 4488	212	omsecor.exe	117
PID 4488 wrote to memory of 4124	4488	omsecor.exe	119
PID 4488 wrote to memory of 4124	4488	omsecor.exe	119
PID 4488 wrote to memory of 4124	4488	omsecor.exe	119
PID 4488 wrote to memory of 4124	4488	omsecor.exe	119
PID 4488 wrote to memory of 4124	4488	omsecor.exe	119

C:\Users\Admin\AppData\Local\Temp\2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_95c55ca881eaad2bd0cc78e2397db250_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 256
        8⤵
        Program crash
        
        PID:4460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 292
        6⤵
        Program crash
        
        PID:3456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 300
      4⤵
      Program crash
      PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 292
  2⤵
  - Program crash
  PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4764 -ip 4764
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4332 -ip 4332
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2436 -ip 2436
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4488 -ip 4488
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
f56ba0ad4067679378c695ee8ad97704

SHA1
5f41a342c75500ab90a1c8d3e7dbf09fc57561b8

SHA256
09f44c3f9a4d04c1ab675d78f9b6c6776f2a86a7f0208afac192582c9c51fb3c

SHA512
cdf816231749dc539ae388d4b8b880d997d8c36cef260f4ddda86d232017764b8f2b3e386d1abe0ce3773d38dbe4e6d5f747addbc7a1d99c2ecd22c39e742204

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
8d433f1e756378d2b2c47f9619bcdd14

SHA1
da7c2f85f5f3d2ae3ed6c95bda68af7697c027de

SHA256
6fc37a910c589582d32cd787a7905ff2a31ec517539ff265b72c799fd0fd6ffc

SHA512
d4592cdafb5cf5108cb6d25437776c1d7c8638d7ec98d43ddbf39f85c2d421cc24968854597591eeaf37976193256dca999218d2901b6d5d7580308551192d4b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
b2cf0555061e67fcf94816eeb42c9008

SHA1
34ac41ae237f762177a2fdf4f73ed73e9c814092

SHA256
3b9d4a4d30c5c55761bbaf5f696bf41f24183a5f2c605c701376d294ed56bbdf

SHA512
cc5e5dddcfaa28af0847aa54eae3c31ba55942a3464e8224af8b59010260b709f3ae6e5e1ab6fa1cc7a997f501abf7fc4bf1c35b1e6af6e01c84c61063106a1a

Download Submit
memory/212-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1104-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2436-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4124-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4124-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4124-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4124-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4332-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4332-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4488-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4636-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4636-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4636-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4636-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4764-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4764-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download