neconyd | 61b62262a2f20e7e9b95487d9eae448c647dd2fabb0a8f4853fe79f46887536f

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_ff5c1f2428fcd26fe71627c9e8902c50_elex_rhadamanthys_stop.exe
Size 61KB
Sample260820-xa85yahk8s
SHA256 61b62262a2f20e7e9b95487d9eae448c647dd2fabb0a8f4853fe79f46887536f
MD5 ff5c1f2428fcd26fe71627c9e8902c50
SHA1 a8efec7b251afbc5c6b7f04e9d7622a6bcb43b16
SHA512 53174ee7309c9af19cadf968c507cf4d3e79b47ca5d6ae19fc3fc690da25fd6e8836ab84ecf94d7979f95ede341e2df5de99496c4b2c10b2f60f282b4b41d12c
SSDEEP 1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSl/5:+dseIOMEZEyFjEOFqTiQmAl/5
TLSH
T138538D55B2F9C075E1A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4412	omsecor.exe
5932	omsecor.exe
5716	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_ff5c1f2428fcd26fe71627c9e8902c50_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4412	5068	2026-08-20_ff5c1f2428fcd26fe71627c9e8902c50_elex_rhadamanthys_stop.exe	89
PID 4412 wrote to memory of 5932	4412	omsecor.exe	91
PID 5932 wrote to memory of 5716	5932	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-20_ff5c1f2428fcd26fe71627c9e8902c50_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ff5c1f2428fcd26fe71627c9e8902c50_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 93611f9e54f685ac7e2e1f5af326182904885a4eddf4f7c3917c30b599ba1665
MD5 345dee1b4c53e100147a03945de5a135
SHA1 7e429f03c39cb20142542428a00ab0b5901472fb
SHA512 44fd2d9a2fc2a80565068d79dec53b69c063eafad0ac1fbd679668d4b884527afbba39f737c4994b5496652bbe8e8dcb91eec129a481e18504a6833ef519469e
SSDEEP 1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSl/5:VdseIOMEZEyFjEOFqTiQmAl/5
TLSH
T1C8538D55B2F9C075E1A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 53de54554d9117cba793f2f53dafc534b39ef31005c99bf033e93a94e7ef7b28
MD5 bb9f4faea05d199ff5359139935adc8f
SHA1 2f27fd655557a7a8b190a2049aa2827875e66da6
SHA512 4695b138946c7511dae350685337276b3145626e7dbd2d45933eb206ae5ff3c15a53afb2d24745332bd8e52707b5706ab1c31c15c221e2111844071dfd5227eb
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSl/5:ydseIOMEZEyFjEOFqTiQmAl/5
TLSH
T140538D55B2F9C075E1A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 65c4465f57c20393efa552e459a2be6d13ec96e78da02b84a56874c8e354d7a1
MD5 c6925f0bc5fa4fb7332eb898b23e70eb
SHA1 6978767a64f336c9d5b230e6b221ce94c846a1b0
SHA512 ba01b47b5270bf4239a08e3c186ca92bf5ebec1479ed165b40ca4a519bff6f0ffb98ee532204e4937b3a56183e705f5e441331ae38c4263970b9339a9873b090
SSDEEP 1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSl/5:NdseIOMEZEyFjEOFqTiQmAl/5
TLSH
T12D538D55B2F9C075E1A309F16A7DAA91C9FEBD3816A0D5C7D3101C8B6EB01D2D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads