neconyd | 09ff0f0a47d7b2f394b097d7d6ac0f136850c93d48b3a900409a300ae3f14f81

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe
Size

134KB
MD5

4bd9da9eb80617169a90260c2e17861a
SHA1

879144ca1f4ea7f053e2d154e9b5e5d8246985c3
SHA256

09ff0f0a47d7b2f394b097d7d6ac0f136850c93d48b3a900409a300ae3f14f81
SHA512

9a720a45636d6a3e6450ea6d47b256efddeb59662a6fae898f588c0411bb8282714410179dcf0be0b980f548aba325e6a3b4fe89ae60d205d083314206a6437a
SSDEEP

1536:rDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiV:niRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2276	omsecor.exe
5420	omsecor.exe
5324	omsecor.exe
5064	omsecor.exe
5548	omsecor.exe
4748	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5804 set thread context of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 2276 set thread context of 5420	2276	omsecor.exe	91
PID 5324 set thread context of 5064	5324	omsecor.exe	121
PID 5548 set thread context of 4748	5548	omsecor.exe	125

Program crash 4 IoCs

pid	pid_target	Process	procid_target
312	5804	WerFault.exe	86
5944	2276	WerFault.exe	89
364	5324	WerFault.exe	120
3912	5548	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 5804 wrote to memory of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 5804 wrote to memory of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 5804 wrote to memory of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 5804 wrote to memory of 3568	5804	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	87
PID 3568 wrote to memory of 2276	3568	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	89
PID 3568 wrote to memory of 2276	3568	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	89
PID 3568 wrote to memory of 2276	3568	2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe	89
PID 2276 wrote to memory of 5420	2276	omsecor.exe	91
PID 2276 wrote to memory of 5420	2276	omsecor.exe	91
PID 2276 wrote to memory of 5420	2276	omsecor.exe	91
PID 2276 wrote to memory of 5420	2276	omsecor.exe	91
PID 2276 wrote to memory of 5420	2276	omsecor.exe	91
PID 5420 wrote to memory of 5324	5420	omsecor.exe	120
PID 5420 wrote to memory of 5324	5420	omsecor.exe	120
PID 5420 wrote to memory of 5324	5420	omsecor.exe	120
PID 5324 wrote to memory of 5064	5324	omsecor.exe	121
PID 5324 wrote to memory of 5064	5324	omsecor.exe	121
PID 5324 wrote to memory of 5064	5324	omsecor.exe	121
PID 5324 wrote to memory of 5064	5324	omsecor.exe	121
PID 5324 wrote to memory of 5064	5324	omsecor.exe	121
PID 5064 wrote to memory of 5548	5064	omsecor.exe	123
PID 5064 wrote to memory of 5548	5064	omsecor.exe	123
PID 5064 wrote to memory of 5548	5064	omsecor.exe	123
PID 5548 wrote to memory of 4748	5548	omsecor.exe	125
PID 5548 wrote to memory of 4748	5548	omsecor.exe	125
PID 5548 wrote to memory of 4748	5548	omsecor.exe	125
PID 5548 wrote to memory of 4748	5548	omsecor.exe	125
PID 5548 wrote to memory of 4748	5548	omsecor.exe	125

C:\Users\Admin\AppData\Local\Temp\2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Users\Admin\AppData\Local\Temp\2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-06_4bd9da9eb80617169a90260c2e17861a_amadey_rhadamanthys_smoke-loader.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5420
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5324
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 224
        8⤵
        Program crash
        
        PID:3912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 296
        6⤵
        Program crash
        
        PID:364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 288
      4⤵
      Program crash
      PID:5944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 288
  2⤵
  - Program crash
  PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5804 -ip 5804
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2276 -ip 2276
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5324 -ip 5324
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5548 -ip 5548
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
522ce97e517354dbddcdeda9a675a955

SHA1
7950a0c3ae7992374dd9da288d2ee80a7443b745

SHA256
6670bfb0be22ef345343ec5809709f049061d0eaf89e5c3a6cf5e25033ce81ce

SHA512
4bd8dcc739c067f63f797e05ea9ceb1888fb5a3f8ffaff6904d59ff2a637aca71dd2ffef16b18e824a816762fb12e1accce367474ebefaa44e03079058338981

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
c79a5bcd28caf59a6222529fd9d1ae0c

SHA1
da6c8c7fb7114d9fb5fbaea3905d9393184738ff

SHA256
4eae31752b2b8c65b34390cc13575a37ba6287bc04ec5d71b5e1894d28ea1b94

SHA512
c3e79e26d481090bf9dae1f2750279470f90cfedce085da7a7f7d73ad2083564e1f23a4d5f1313eb321bbbadea13f14eccc7f3674908f737023768141835ba74

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
f8bfee1f707f0d063c5dec90dd7951be

SHA1
57e124c082bd5352cc277498f9c882d1c1315467

SHA256
34fe16d09276268634a3866914700d03f9e5dbac4291ccf0755eb9a4194c36d7

SHA512
97a845ebee50d82e928691a1bd3e13247140fe9468a287b8298f1208f0c39bf4dbac4ae2d59e80ad9f4c1f05cec083dba3eb0cfb2873dd29631fd6cd57d8a9e0

Download Submit
memory/2276-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3568-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3568-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3568-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3568-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4748-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4748-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4748-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4748-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5064-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5064-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5064-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5324-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5324-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5420-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5420-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5548-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5804-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5804-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download