neconyd | e21de0447a4e15e5a9c2790af38893750d9a4972024577b01802e6f193384298

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_cc1897e8fa32ae8b86364e63faa52276_elex_rhadamanthys_stop.exe
Size 61KB
Sample260606-ptqtpse17n
SHA256 e21de0447a4e15e5a9c2790af38893750d9a4972024577b01802e6f193384298
MD5 cc1897e8fa32ae8b86364e63faa52276
SHA1 57c5aefc07609ba62c9b5c6692f5778bb57f476d
SHA512 042b9a4e1fc1c4f6257bfc256cdac2e2676b4694319eb34d84274d1da57c7b84592881939ea2602b77df6949e945df3f53e6f53cc12693b41a0664d1b6759379
SSDEEP 1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZGl/5:mdseIOMEZEyFjEOFqTiQmwl/5
TLSH
T17E538D55B2F9C075E5A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4924	omsecor.exe
2504	omsecor.exe
984	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_cc1897e8fa32ae8b86364e63faa52276_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4924	2404	2026-06-06_cc1897e8fa32ae8b86364e63faa52276_elex_rhadamanthys_stop.exe	82
PID 4924 wrote to memory of 2504	4924	omsecor.exe	86
PID 2504 wrote to memory of 984	2504	omsecor.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-06_cc1897e8fa32ae8b86364e63faa52276_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_cc1897e8fa32ae8b86364e63faa52276_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 f2a0f9ea48e7d211eeaed1640f906bf530f548341e124a4c1d05af7fa47f386e
MD5 2af288f7bf73f0ae3f32f2ed3d0d45ac
SHA1 9594149661705f3d1a4f73b09eb88ce2d59f3f58
SHA512 8e0a4d826601dd13d5bf8c91259fc47810ae5614d6fa5331304b44163b275c25ace422809df7eb2700116313e12be195f38eb5a9f8e6887a0f8057deccc1a318
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZGl/5:ydseIOMEZEyFjEOFqTiQmwl/5
TLSH
T1A6538D55B2F9C075E5A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 6bb5baccd2f6edd47c152156992534f1c41c1ff74c77ded95121c036706feced
MD5 afc7ae43629d0b3c8be5787c3def0a9b
SHA1 3353e54e136d42675978c22ef2ffec24c0348ea1
SHA512 f2734514b6e1cb65384aaa00faac0ccf36ddce02e293fb26a0d49302852e2e451cf869eb24271225d6cc95ada131cf1e1ac1a7d136a8367ab9f6278364085b88
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZGl/5:ydseIOMEZEyFjEOFqTiQmwl/5
TLSH
T164538D55B2F9C075E5A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 a4a76bbb9e505cfafc83b64ec9e36db77fc44ed42ad178b01d9d0e89c957a200
MD5 c1d8014094241308e40594852ad53e79
SHA1 35342ed6eefb2be422827c1253d2cdb9c52c1ee2
SHA512 44a14aa5a6155e554b2570a452538917803329a8eec71808c5bcf0a5825e8d0937dd9c37501db6667573e6da17cc5b34cddb25716f6407ef7ff82d5c43080be8
SSDEEP 1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZGl/5:mdseIOMEZEyFjEOFqTiQmwl/5
TLSH
T1AC538D55B2F9C075E5A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads