neconyd | 505439074ce29ddb3cbead3bfadd94aa11b0bda195f1ebc22ad9b16a9516558d

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

02111f1d8a19dae5623150f5fbaee01d
SHA1

e96d5b999c7291febd9559a899ce00885ccfa4ac
SHA256

505439074ce29ddb3cbead3bfadd94aa11b0bda195f1ebc22ad9b16a9516558d
SHA512

9d043adb77bdd6f02c0810fc931446344c425d3aad6d7fd99b8ce9e5a42b820dd509689fa11eefa891f6b439fb1c01d2e848940a9d0a81bae68ac28c2861c66f
SSDEEP

1536:2DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:oiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1880	omsecor.exe
1488	omsecor.exe
1032	omsecor.exe
1688	omsecor.exe
1112	omsecor.exe
1792	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 1880 set thread context of 1488	1880	omsecor.exe	90
PID 1032 set thread context of 1688	1032	omsecor.exe	115
PID 1112 set thread context of 1792	1112	omsecor.exe	119

Program crash 4 IoCs

pid	pid_target	Process	procid_target
400	3876	WerFault.exe	85
1500	1880	WerFault.exe	89
1428	1032	WerFault.exe	114
4776	1112	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 3876 wrote to memory of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 3876 wrote to memory of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 3876 wrote to memory of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 3876 wrote to memory of 1780	3876	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	86
PID 1780 wrote to memory of 1880	1780	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	89
PID 1780 wrote to memory of 1880	1780	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	89
PID 1780 wrote to memory of 1880	1780	2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe	89
PID 1880 wrote to memory of 1488	1880	omsecor.exe	90
PID 1880 wrote to memory of 1488	1880	omsecor.exe	90
PID 1880 wrote to memory of 1488	1880	omsecor.exe	90
PID 1880 wrote to memory of 1488	1880	omsecor.exe	90
PID 1880 wrote to memory of 1488	1880	omsecor.exe	90
PID 1488 wrote to memory of 1032	1488	omsecor.exe	114
PID 1488 wrote to memory of 1032	1488	omsecor.exe	114
PID 1488 wrote to memory of 1032	1488	omsecor.exe	114
PID 1032 wrote to memory of 1688	1032	omsecor.exe	115
PID 1032 wrote to memory of 1688	1032	omsecor.exe	115
PID 1032 wrote to memory of 1688	1032	omsecor.exe	115
PID 1032 wrote to memory of 1688	1032	omsecor.exe	115
PID 1032 wrote to memory of 1688	1032	omsecor.exe	115
PID 1688 wrote to memory of 1112	1688	omsecor.exe	117
PID 1688 wrote to memory of 1112	1688	omsecor.exe	117
PID 1688 wrote to memory of 1112	1688	omsecor.exe	117
PID 1112 wrote to memory of 1792	1112	omsecor.exe	119
PID 1112 wrote to memory of 1792	1112	omsecor.exe	119
PID 1112 wrote to memory of 1792	1112	omsecor.exe	119
PID 1112 wrote to memory of 1792	1112	omsecor.exe	119
PID 1112 wrote to memory of 1792	1112	omsecor.exe	119

C:\Users\Admin\AppData\Local\Temp\2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_02111f1d8a19dae5623150f5fbaee01d_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 256
        8⤵
        Program crash
        
        PID:4776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 296
        6⤵
        Program crash
        
        PID:1428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 288
      4⤵
      Program crash
      PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 300
  2⤵
  - Program crash
  PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3876 -ip 3876
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1880 -ip 1880
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1032 -ip 1032
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1112 -ip 1112
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
7dc70ea8840f5b51319e551da0aad186

SHA1
5735407183969d599db5fdae6348869000a8960e

SHA256
0dd629066f09e93d469e8847bc7bb20b11a4519f43822a47c42233966f09d5b8

SHA512
884987df3623f0007e34d1cc9674000bf80f54b4ef37839cac03167c98274a0802029ea00c90c4e1f9307f5d7342eb493c353346093da6504b5320217ad79442

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
b83b15a3f9068a92dc4a5db92a5d05ca

SHA1
3c89c3eb0119b9dbf8dfbe1b05f1fe0d1f03e9b7

SHA256
116659a648e0304ab7e7a3da9b12bcead3bddf80ba214780672b475b8e49936c

SHA512
8a3bd9aab47d52f1f1f35f7d4508849edf84f3c8abbfd216dbfb923e9b766f9883ba83a50dad6f5d58cf36ca9e1c2c3c893827f69261a7759916264b58d24ee4

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
e34cc16775313b653f60fc9c1199edd6

SHA1
c16a8911e9d5d64011b1b115525646a6aad43627

SHA256
63dfcd9ae85525f93754da22ae0eb6fbe962451575718ad3d6ed8c7dae1b4056

SHA512
a67d026f3358a486cab4dd2f9dc0612f0d9f0bafc041f922730db3b2c6af2c4a14a459d7be9182c12113fc491319253da70fa2e0d5ce04f58e56d5722414ebb1

Download Submit
memory/1032-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1032-34-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1112-45-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1488-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1688-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1688-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1688-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1780-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1780-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1780-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1780-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1792-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1792-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1792-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1792-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1880-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1880-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3876-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3876-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download