neconyd | e691fbfac7e3edb15fb37e6a1f727ab6b667148a661d64251f5d0370a766777a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2641ff65e57fbdc783127b70a64904c0_elex_rhadamanthys_stop.exe
Size 61KB
Sample260415-khbs7acy4y
SHA256 e691fbfac7e3edb15fb37e6a1f727ab6b667148a661d64251f5d0370a766777a
MD5 2641ff65e57fbdc783127b70a64904c0
SHA1 1c02c8f560f397503afe2b091ddaae2d709fdbb6
SHA512 6c5c3d9a16f29ae39b18e31054f72209018a237b583a669b3f0b12c4dd4736265502b4d12d99b907f011085a075d987571ecd5e54d6a9f1f253a653266a60628
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZUl/5:JdseIOMEZEyFjEOFqTiQmal/5
TLSH
T161538D95B2F9C075E1A309B17A7DAA91C9FEBD3816A0D5C7D3101C876EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2784	omsecor.exe
3252	omsecor.exe
3888	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_2641ff65e57fbdc783127b70a64904c0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2784	2388	2026-04-15_2641ff65e57fbdc783127b70a64904c0_elex_rhadamanthys_stop.exe	80
PID 2784 wrote to memory of 3252	2784	omsecor.exe	81
PID 3252 wrote to memory of 3888	3252	omsecor.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2641ff65e57fbdc783127b70a64904c0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2641ff65e57fbdc783127b70a64904c0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 c771aea33ef4b784cfc2d281bf7473e99014154d0e117ff061745c9721f7843d
MD5 87029c9065a087f2305a9a1a7882139c
SHA1 b1915c2ec61c3b90033be78c174f17209f817987
SHA512 d88c9189d0dd230f3706c9163b4db195f1e72f5d77d832e562b50c02f926d98fa2692f29edb4f6f5bc27c6d90c6f838acfce994233c74125684afa755daed43a
SSDEEP 1536:8d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZUl/5:EdseIOMEZEyFjEOFqTiQmal/5
TLSH
T126538D95B2F9C075E5A309B17A7DAA91C9FEBD3816A0D5C7D3101C876EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 890f489fa56f417629b97c3f23f72a7c7f1abc2ebedd35f212cc7ed5a2a4f31f
MD5 94735a7e67d4c9c76ed33449c0bd7da8
SHA1 86284eea9a512247e01cce836bb4e3082be09324
SHA512 5f33c863b744d68672e264dcacdf5dd05768e055d5841a2ce3d1c3c81470b12ae464063251dda1e7be580f7ebaa3b6a7d281f8bff850d5d19fe4ec9e8504ff5a
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZUl/5:JdseIOMEZEyFjEOFqTiQmal/5
TLSH
T1D9538D9572F9C075E1A309B17A7DAA91C9FEBD3816A0D5C7D3101C876EB01D2D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 cdd69c669ce8c17c00e516ad2766f685e8d7ed1e094edef67ff59c23f3cc2bb6
MD5 65ef62bdaa7ccbbd073e61636eaaaec3
SHA1 a07ecf1d0706e2e6b2136b5fbbd901cb7e4d865e
SHA512 d13e7a353a5088790d85b34e09d3baa87ef6a70e4264f4ff02c15d7995f222563b3e9fb5bf5b1180ce7964b1a55a41d29fe903f153e5d69fc726fe238fb3f1fd
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZUl/5:BdseIOMEZEyFjEOFqTiQmal/5
TLSH
T10E538D95B2F9C075E1A309B17A7DAA91C9FEBD3816A0D5C7D3101C876EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-3-0x0000000000AF0000-0x0000000000C3D000-memory.dmp

Download

memory/2784-5-0x0000000000870000-0x00000000009BD000-memory.dmp

Download

memory/2784-18-0x0000000000870000-0x00000000009BD000-memory.dmp

Download

memory/3252-22-0x0000000000840000-0x000000000098D000-memory.dmp

Download

memory/3888-24-0x00000000009F0000-0x0000000000B3D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads