neconyd | 197f8e35c71377880bb03a5ca81f8c4128730bfe54d616c959ed30e2dd35b0ee

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

64127df693c29a73f1def27c7276408e
SHA1

4ae49d00c42121a95fedb336c37d0cbb3d11213f
SHA256

197f8e35c71377880bb03a5ca81f8c4128730bfe54d616c959ed30e2dd35b0ee
SHA512

b17994a22b6b92be1572e8d9b96dafa8078c96deb971093f2f8cfaa01246e06777a7ec3b24997a422d25d767870a5685985c84a192efb3c1415eb19a61b56022
SSDEEP

1536:HDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCit:jiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4880	omsecor.exe
4508	omsecor.exe
5732	omsecor.exe
1588	omsecor.exe
2568	omsecor.exe
4012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 4880 set thread context of 4508	4880	omsecor.exe	90
PID 5732 set thread context of 1588	5732	omsecor.exe	113
PID 2568 set thread context of 4012	2568	omsecor.exe	117

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1492	1792	WerFault.exe	84
2008	4880	WerFault.exe	87
516	5732	WerFault.exe	112
1664	2568	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 1792 wrote to memory of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 1792 wrote to memory of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 1792 wrote to memory of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 1792 wrote to memory of 6068	1792	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	85
PID 6068 wrote to memory of 4880	6068	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	87
PID 6068 wrote to memory of 4880	6068	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	87
PID 6068 wrote to memory of 4880	6068	2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe	87
PID 4880 wrote to memory of 4508	4880	omsecor.exe	90
PID 4880 wrote to memory of 4508	4880	omsecor.exe	90
PID 4880 wrote to memory of 4508	4880	omsecor.exe	90
PID 4880 wrote to memory of 4508	4880	omsecor.exe	90
PID 4880 wrote to memory of 4508	4880	omsecor.exe	90
PID 4508 wrote to memory of 5732	4508	omsecor.exe	112
PID 4508 wrote to memory of 5732	4508	omsecor.exe	112
PID 4508 wrote to memory of 5732	4508	omsecor.exe	112
PID 5732 wrote to memory of 1588	5732	omsecor.exe	113
PID 5732 wrote to memory of 1588	5732	omsecor.exe	113
PID 5732 wrote to memory of 1588	5732	omsecor.exe	113
PID 5732 wrote to memory of 1588	5732	omsecor.exe	113
PID 5732 wrote to memory of 1588	5732	omsecor.exe	113
PID 1588 wrote to memory of 2568	1588	omsecor.exe	115
PID 1588 wrote to memory of 2568	1588	omsecor.exe	115
PID 1588 wrote to memory of 2568	1588	omsecor.exe	115
PID 2568 wrote to memory of 4012	2568	omsecor.exe	117
PID 2568 wrote to memory of 4012	2568	omsecor.exe	117
PID 2568 wrote to memory of 4012	2568	omsecor.exe	117
PID 2568 wrote to memory of 4012	2568	omsecor.exe	117
PID 2568 wrote to memory of 4012	2568	omsecor.exe	117

C:\Users\Admin\AppData\Local\Temp\2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_64127df693c29a73f1def27c7276408e_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5732
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 256
        8⤵
        Program crash
        
        PID:1664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 292
        6⤵
        Program crash
        
        PID:516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 288
      4⤵
      Program crash
      PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 288
  2⤵
  - Program crash
  PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1792 -ip 1792
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4880 -ip 4880
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5732 -ip 5732
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2568 -ip 2568
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
22bf4b2456ef19ccc494b7e11c45b943

SHA1
9e0b6cf76d7cd68ba15a72c4cf0f38a1e3667526

SHA256
6c67f6cc73f18c39ba52185a5f2c651680a689390f6f37af9c09bbf5e243f02e

SHA512
d6f950ab160df1f927c260b02292de2a5e6656dccc2f68fd584ed13755f963bc6859a56f037f5b71fe61ab36440a01be8935addb55720e3731150ca90c1dd4ed

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
8b88fe3ed1d18661715c8152e03bb42d

SHA1
55ac62dfa9e87ec404aa7ef9a6121dfe109594a6

SHA256
032f296e09c8df053ca99e77f81c3c13d65998f75b16e3d14077218fa6c0f32b

SHA512
4e04d5cefe643e40f84dee7870c1bcb2f57a972d1ba4f58ae5151468dfc95ceea05900d7b70efbf9814d3e2a97f48caec8da46f5ee059696678bb96e36a9c42d

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
e9657e7c45510eb7594aad2a5cdd2d78

SHA1
e3cf1be743db26f9cf4fdaea241318e987fca239

SHA256
58d1d47226f03d2cefd3ab9be4d535a3861daafd06c75d6cce42809b04fc811c

SHA512
a102077ffe287fed9ab09e64b59624456f0a329c0bc24efe12150735bef3c06ec91f157a3169917d926e71e5aa076c00f69b88ceef984b7c7f8bd3aa681095f0

Download Submit
memory/1588-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1588-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1588-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1792-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1792-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2568-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4012-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4012-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4508-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4880-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4880-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5732-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5732-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6068-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6068-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6068-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6068-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download