neconyd | 3c7158f35521a430b0f2fee7d355781a43d231c5f09a26d1f48808ca0b26159d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_f7ee12b9fb37b06b90cfe7ef70ebdf29_elex_rhadamanthys_stop.exe
Size 61KB
Sample260530-ssa9eagy6z
SHA256 3c7158f35521a430b0f2fee7d355781a43d231c5f09a26d1f48808ca0b26159d
MD5 f7ee12b9fb37b06b90cfe7ef70ebdf29
SHA1 af43ad0ea18b3bc39825ff6f5633fd68a19de3f6
SHA512 05200a5c50772380571e89a8acaba02a471288250bd582006019a93a6c1ab7e7dbfec16392a9900ead94279dd47ce80eeb53de2af4af983a00fdafdbde3f575a
SSDEEP 1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZil/5:mdseIOMEZEyFjEOFqTiQmol/5
TLSH
T113538D55B2F9C075E5A309F1657DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3312	omsecor.exe
6124	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_f7ee12b9fb37b06b90cfe7ef70ebdf29_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 3312	5444	2026-05-30_f7ee12b9fb37b06b90cfe7ef70ebdf29_elex_rhadamanthys_stop.exe	80
PID 3312 wrote to memory of 6124	3312	omsecor.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-30_f7ee12b9fb37b06b90cfe7ef70ebdf29_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_f7ee12b9fb37b06b90cfe7ef70ebdf29_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 61fbeb515dedbf2dfbfabfd2b594af83901ad242039d3fd9260b3dfbeaf98896
MD5 90885101bafbb3476519654aca18139b
SHA1 e5c185e06cf45680c4abc055c3f8e6d9141ab69b
SHA512 cf6c8951bd5f3aab531f133e5b82c41f2cfa48646ec7109ed84e8bb27ae588bb1ae69c01ee38d60d3a733c3b257b7459fdb973c3bcea2d1cbcc5f3c1b79a561b
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZil/5:ydseIOMEZEyFjEOFqTiQmol/5
TLSH
T1AD538D55B2F9C075E5A309F1657DAA91C9FEBD3815A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download