neconyd | b5ff09c2415a4fa5bbe3aab5a43e64c1e40feaf0240f523ff4130c048b17582f

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

41205eeae9db219b11953ff54c72a19e
SHA1

afe3b6bd83b0f1c0232503b1156540762222357d
SHA256

b5ff09c2415a4fa5bbe3aab5a43e64c1e40feaf0240f523ff4130c048b17582f
SHA512

352c5a6cd6517489d48168bb2e3aae9b2de52d7eb8252fe9c68756882f5e0135e0173c03a556e16d5eeb4f27128ded450c7fea95ce06cca895d5b396ffd3f382
SSDEEP

1536:9DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:NiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
5696	omsecor.exe
2904	omsecor.exe
1416	omsecor.exe
2916	omsecor.exe
3304	omsecor.exe
1600	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 5696 set thread context of 2904	5696	omsecor.exe	93
PID 1416 set thread context of 2916	1416	omsecor.exe	118
PID 3304 set thread context of 1600	3304	omsecor.exe	122

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3592	2796	WerFault.exe	88
5256	5696	WerFault.exe	92
3496	1416	WerFault.exe	117
5116	3304	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 2796 wrote to memory of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 2796 wrote to memory of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 2796 wrote to memory of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 2796 wrote to memory of 2924	2796	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 2924 wrote to memory of 5696	2924	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	92
PID 2924 wrote to memory of 5696	2924	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	92
PID 2924 wrote to memory of 5696	2924	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	92
PID 5696 wrote to memory of 2904	5696	omsecor.exe	93
PID 5696 wrote to memory of 2904	5696	omsecor.exe	93
PID 5696 wrote to memory of 2904	5696	omsecor.exe	93
PID 5696 wrote to memory of 2904	5696	omsecor.exe	93
PID 5696 wrote to memory of 2904	5696	omsecor.exe	93
PID 2904 wrote to memory of 1416	2904	omsecor.exe	117
PID 2904 wrote to memory of 1416	2904	omsecor.exe	117
PID 2904 wrote to memory of 1416	2904	omsecor.exe	117
PID 1416 wrote to memory of 2916	1416	omsecor.exe	118
PID 1416 wrote to memory of 2916	1416	omsecor.exe	118
PID 1416 wrote to memory of 2916	1416	omsecor.exe	118
PID 1416 wrote to memory of 2916	1416	omsecor.exe	118
PID 1416 wrote to memory of 2916	1416	omsecor.exe	118
PID 2916 wrote to memory of 3304	2916	omsecor.exe	120
PID 2916 wrote to memory of 3304	2916	omsecor.exe	120
PID 2916 wrote to memory of 3304	2916	omsecor.exe	120
PID 3304 wrote to memory of 1600	3304	omsecor.exe	122
PID 3304 wrote to memory of 1600	3304	omsecor.exe	122
PID 3304 wrote to memory of 1600	3304	omsecor.exe	122
PID 3304 wrote to memory of 1600	3304	omsecor.exe	122
PID 3304 wrote to memory of 1600	3304	omsecor.exe	122

C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1416
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 268
        8⤵
        Program crash
        
        PID:5116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 292
        6⤵
        Program crash
        
        PID:3496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 288
      4⤵
      Program crash
      PID:5256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 288
  2⤵
  - Program crash
  PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2796 -ip 2796
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5696 -ip 5696
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1416 -ip 1416
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3304 -ip 3304
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
10088beecaafad68afea088299553355

SHA1
215ea81a85b235607da3b5f95a2493f7115d5fe6

SHA256
c69a5f3c20b40ed630930726310a6ed1bff3c534c53f180ad851767365ac21ad

SHA512
8a1ef7313d4d2c0a152e2c53b31dad9e238c8305f79c5fb2c94a315890002fbd9e854009ba24387f9b09c768e8ec28bac7c0f926edb3643fa322cc4717db3a2c

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
3cdb3e6e72cd72e14c163bb9d924e6ec

SHA1
86e132edffc6aac5e2897575a681e5c0a4aaba48

SHA256
daf7ba25878e89706dfb3f4bfaa40212623207bbc49a893b68bb27bc6529b750

SHA512
43063bb1eb8a5480ffffcfb77c7f0012a1eaeec3b1589bffd138e5943ccd31ad4b1623bd60eb15ca9b66d9e7254f1ad3a4d6044c929ee51d2f8c8d2afa8150fc

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
36d576a25bb848f624afb2a69365b400

SHA1
76addd3cb8c8802ad0ddc0f3541b910014274e7c

SHA256
23c7cd14364c404f4b61cd66d6a98c480132cd91e5da3df0ceaa9f456af59829

SHA512
c85e4de57f597fec454b5efc4387276a71a0856ad6b24e1897468467b650d3b6a0d7cac8fc7487b56f3de53117b0e134adadbfa363bd4d71ae5c8df44be5910f

Download Submit
memory/1416-33-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1600-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1600-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1600-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1600-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2796-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2904-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2904-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3304-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3304-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5696-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download