Analysis

  • max time kernel
    144s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/07/2025, 18:52

General

  • Target

    2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe

  • Size

    134KB

  • MD5

    b605fbc7a11d3e1b799e6980118313ed

  • SHA1

    1bcb8685cbe83507323a269c0ac47fc72264e9d7

  • SHA256

    8c38c395be0daf5c90ffd44263af56a2d5fa0d109dd03fbca087ad6f976c1f3f

  • SHA512

    99ef6ca59efd0ab33cb7727bb5615fb4278e3f2de7af2141a7bd668cde89690f87335071e3d24ca283f7479b2ee1a4a9e8f394752c80ff6d1c4174063239e8dd

  • SSDEEP

    1536:oDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:OiRTeH0iqAW6J6f1tqF6dngNmaZCia

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Neconyd family
  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
      C:\Users\Admin\AppData\Local\Temp\2025-07-02_b605fbc7a11d3e1b799e6980118313ed_amadey_elex_rhadamanthys_smoke-loader_stop.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5700
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4924
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5040
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5780
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 268
                  8⤵
                  • Program crash
                  PID:5048
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 304
              6⤵
              • Program crash
              PID:1996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 312
          4⤵
          • Program crash
          PID:2376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 300
      2⤵
      • Program crash
      PID:780
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1776 -ip 1776
    1⤵
      PID:2100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4144 -ip 4144
      1⤵
        PID:2840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4924 -ip 4924
        1⤵
          PID:4876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5040 -ip 5040
          1⤵
            PID:404

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  bc70b2c2d130a9d979c297e9c1e87980

                  SHA1

                  d924ec21cdbb6d9b48d79fa373689a674e59f59a

                  SHA256

                  4507c07a5a14dbbdbbd9a91b48f3889a53f1ebfab59d967bf04671b3eb54ee28

                  SHA512

                  e61d03f2206365eb13597ddf1c26ed602ab4ec7258c48fa6da92d7713cdb324ba2448f39a4a501b50c0a10208b210597928db743bb448d26be8a4df6274d6841

                • C:\Users\Admin\AppData\Roaming\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  594332f25218c9cb36a5186a39612da5

                  SHA1

                  a80a3fc1f2fe0750d43697a061a4eacc626e01eb

                  SHA256

                  524dbafcdccf5c36ae9efff0c4714309875c372bf590466e6dffdd3379b46020

                  SHA512

                  e1c809c1fc4c70e6d4dab831162e840293e1618f8bcb35e1d3695b53dec35fb7191c54e1cd2186302121009cfe38b40092472c7e32c0432d60b47173e42b9e85

                • C:\Windows\SysWOW64\omsecor.exe

                  Filesize

                  134KB

                  MD5

                  b898f671200923edec86c5e9f6c21b60

                  SHA1

                  1160b70a770a251861c76736ff2700a98765ae90

                  SHA256

                  0f265bb4acaf8b8b2d104e0413281da9e9cb451536e0489eb0bd391f99153f5c

                  SHA512

                  3ecf29d186426478e040f3e8df8936820ac513bed37d6f6388124e13fc3ae13fe356a13d08d7fe3c3aa7ea2f2d5abfd45edd2da7f599fdae3b44d6ff8ef8aeac

                • memory/1776-0-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/1776-17-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/3452-18-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-14-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-15-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-25-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-21-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-24-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/3452-33-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4144-8-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/4144-16-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/4924-51-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/4924-35-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/4984-38-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4984-43-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/4984-39-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5040-46-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                • memory/5700-1-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5700-2-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5700-5-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5700-3-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5780-50-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5780-52-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB

                • memory/5780-55-0x0000000000400000-0x0000000000429000-memory.dmp

                  Filesize

                  164KB