neconyd | b5ff09c2415a4fa5bbe3aab5a43e64c1e40feaf0240f523ff4130c048b17582f

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

41205eeae9db219b11953ff54c72a19e
SHA1

afe3b6bd83b0f1c0232503b1156540762222357d
SHA256

b5ff09c2415a4fa5bbe3aab5a43e64c1e40feaf0240f523ff4130c048b17582f
SHA512

352c5a6cd6517489d48168bb2e3aae9b2de52d7eb8252fe9c68756882f5e0135e0173c03a556e16d5eeb4f27128ded450c7fea95ce06cca895d5b396ffd3f382
SSDEEP

1536:9DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:NiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
6092	omsecor.exe
1920	omsecor.exe
2840	omsecor.exe
1060	omsecor.exe
4576	omsecor.exe
4284	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 6092 set thread context of 1920	6092	omsecor.exe	92
PID 2840 set thread context of 1060	2840	omsecor.exe	116
PID 4576 set thread context of 4284	4576	omsecor.exe	119

Program crash 4 IoCs

pid	pid_target	Process	procid_target
224	1036	WerFault.exe	84
836	6092	WerFault.exe	89
1788	2840	WerFault.exe	115
228	4576	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 1036 wrote to memory of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 1036 wrote to memory of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 1036 wrote to memory of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 1036 wrote to memory of 5240	1036	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	87
PID 5240 wrote to memory of 6092	5240	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 5240 wrote to memory of 6092	5240	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 5240 wrote to memory of 6092	5240	2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe	89
PID 6092 wrote to memory of 1920	6092	omsecor.exe	92
PID 6092 wrote to memory of 1920	6092	omsecor.exe	92
PID 6092 wrote to memory of 1920	6092	omsecor.exe	92
PID 6092 wrote to memory of 1920	6092	omsecor.exe	92
PID 6092 wrote to memory of 1920	6092	omsecor.exe	92
PID 1920 wrote to memory of 2840	1920	omsecor.exe	115
PID 1920 wrote to memory of 2840	1920	omsecor.exe	115
PID 1920 wrote to memory of 2840	1920	omsecor.exe	115
PID 2840 wrote to memory of 1060	2840	omsecor.exe	116
PID 2840 wrote to memory of 1060	2840	omsecor.exe	116
PID 2840 wrote to memory of 1060	2840	omsecor.exe	116
PID 2840 wrote to memory of 1060	2840	omsecor.exe	116
PID 2840 wrote to memory of 1060	2840	omsecor.exe	116
PID 1060 wrote to memory of 4576	1060	omsecor.exe	118
PID 1060 wrote to memory of 4576	1060	omsecor.exe	118
PID 1060 wrote to memory of 4576	1060	omsecor.exe	118
PID 4576 wrote to memory of 4284	4576	omsecor.exe	119
PID 4576 wrote to memory of 4284	4576	omsecor.exe	119
PID 4576 wrote to memory of 4284	4576	omsecor.exe	119
PID 4576 wrote to memory of 4284	4576	omsecor.exe	119
PID 4576 wrote to memory of 4284	4576	omsecor.exe	119

C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_41205eeae9db219b11953ff54c72a19e_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 256
        8⤵
        Program crash
        
        PID:228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 292
        6⤵
        Program crash
        
        PID:1788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 288
      4⤵
      Program crash
      PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 288
  2⤵
  - Program crash
  PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1036 -ip 1036
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6092 -ip 6092
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2840 -ip 2840
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4576 -ip 4576
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
7ee29ff6043a734e4a2e7cc7ac6a4264

SHA1
4357cfbefb174c717f242527ecedb9d132218167

SHA256
d99ba1d191a7e76f75ce2db240a012500bf4f2db759b7fb4b77f63eb1f451ffe

SHA512
6e1dab25a39ec843027bd220af0d132011bfe61cca0337ab624c50f55de31023ff1ba20579883a34965a4d2e384af3c3eb29f6e3e05cdcba1a90df3274afc331

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
3cdb3e6e72cd72e14c163bb9d924e6ec

SHA1
86e132edffc6aac5e2897575a681e5c0a4aaba48

SHA256
daf7ba25878e89706dfb3f4bfaa40212623207bbc49a893b68bb27bc6529b750

SHA512
43063bb1eb8a5480ffffcfb77c7f0012a1eaeec3b1589bffd138e5943ccd31ad4b1623bd60eb15ca9b66d9e7254f1ad3a4d6044c929ee51d2f8c8d2afa8150fc

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
da7e86be2f2e4799bf37b0d8b41c3fc7

SHA1
cb436e459ff679af18b8bb59053e9e972600c372

SHA256
2b6d0109005980a3622b1454c748d1632039f5965e9324239af7eb2f38539052

SHA512
fe3ed6f62464f561fa10106bc721fee487dd26bcb2663a339baab9008e6f52b8169ba121133798d500a95accfff6075bc7fb75895bafca100555f3406fe7bfd6

Download Submit
memory/1036-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1036-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1060-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1060-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1060-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2840-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4284-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4284-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4284-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4284-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4576-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5240-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5240-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5240-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5240-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6092-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6092-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download