Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 18:52

General

  • Target

    2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe

  • Size

    134KB

  • MD5

    b605fbc7a11d3e1b799e6980118313ed

  • SHA1

    1bcb8685cbe83507323a269c0ac47fc72264e9d7

  • SHA256

    8c38c395be0daf5c90ffd44263af56a2d5fa0d109dd03fbca087ad6f976c1f3f

  • SHA512

    99ef6ca59efd0ab33cb7727bb5615fb4278e3f2de7af2141a7bd668cde89690f87335071e3d24ca283f7479b2ee1a4a9e8f394752c80ff6d1c4174063239e8dd

  • SSDEEP

    1536:oDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:OiRTeH0iqAW6J6f1tqF6dngNmaZCia

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
      C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5432
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2020
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2320
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5472
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4508
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 260
                  8⤵
                  • Program crash
                  PID:3196
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 300
              6⤵
              • Program crash
              PID:1192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 296
          4⤵
          • Program crash
          PID:3860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 288
      2⤵
      • Program crash
      PID:5296
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 692 -ip 692
    1⤵
      PID:4436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2632 -ip 2632
      1⤵
        PID:3280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2320 -ip 2320
        1⤵
          PID:1256
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5472 -ip 5472
          1⤵
            PID:312

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  594332f25218c9cb36a5186a39612da5

                  SHA1

                  a80a3fc1f2fe0750d43697a061a4eacc626e01eb

                  SHA256

                  524dbafcdccf5c36ae9efff0c4714309875c372bf590466e6dffdd3379b46020

                  SHA512

                  e1c809c1fc4c70e6d4dab831162e840293e1618f8bcb35e1d3695b53dec35fb7191c54e1cd2186302121009cfe38b40092472c7e32c0432d60b47173e42b9e85

                • C:\Users\Admin\AppData\Roaming\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  93f948448d75fe7a4a4a4e883e937be6

                  SHA1

                  b8fa1a12459296bf611d5039b1b369f1b87d4713

                  SHA256

                  145c6d0b7a309f13ed2073c00570f9234da70fc09cbd5037f8b4db193c75ff99

                  SHA512

                  b5556b5661fc2574a33e71b9d163bdf774a281512316e437ecd1cfae0ab421fbcf32847bdd74b80c7806db96701681f0addc3ea7596c8b21b0b5c6bbe34423b9

                • C:\Windows\SysWOW64\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  3e38ddac45ebfa9faa6c069ca99170b6

                  SHA1

                  36093179f7a490e0300d5f36ed3541cf905b3eda

                  SHA256

                  fe80f07891d5ad1229ea7cb1e873529c9c97bfe733809aeaecbc67987fbc396f

                  SHA512

                  14d120211e99b2d71dcf7f8279593fc81c90816b5124779c13f0f6ab1660f362131e4cc6c58762ce577d7b83e88e6820dc62891fcf586ef4c340bd882232e67f

                • memory/692-0-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/692-16-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/2020-25-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-21-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-14-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-15-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-31-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-24-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2020-18-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/2320-32-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/2320-51-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/2632-9-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/2632-17-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/3340-40-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3340-38-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3340-37-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4508-50-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4508-49-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4508-52-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4508-55-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5432-2-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5432-1-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5432-5-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5432-3-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5472-45-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB