neconyd | f8e13695ded105db9c76cfae3b4b22b2502ae5af6fd5ab4ad8af08ede44e70e2

General

Target
2026-11-05_95b97ac3988a50f8816ef1405a0d0c5f_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261106-s2944acw2v
SHA256 f8e13695ded105db9c76cfae3b4b22b2502ae5af6fd5ab4ad8af08ede44e70e2
MD5 95b97ac3988a50f8816ef1405a0d0c5f
SHA1 7ea3ae26bb63bbb385b4afd66391584f2f43bcf9
SHA512 608391600e1f54d10033637140c5bb945351aafab0be981095835986645010879e048f10f1f45379514e1ff3b252438d0dfccd195f07f8744e1a7d5ccf1b7031
SSDEEP 24576:4OsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:h6W+TFq6IZj8N2Y7T5GF
TLSH
T12AF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
5372	omsecor.exe
4732	omsecor.exe
3540	omsecor.exe
5132	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_95b97ac3988a50f8816ef1405a0d0c5f_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5372	4136	2026-11-05_95b97ac3988a50f8816ef1405a0d0c5f_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	89
PID 5372 wrote to memory of 4732	5372	omsecor.exe	91
PID 4732 wrote to memory of 3540	4732	omsecor.exe	92
PID 3540 wrote to memory of 5132	3540	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-05_95b97ac3988a50f8816ef1405a0d0c5f_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_95b97ac3988a50f8816ef1405a0d0c5f_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 7263f72798364ff38e4b8d305e78aaef732cc03f29a2d4e9498b099ea64aa992
MD5 e1ec40d4e3c9fda7590a26a7f5afe3bd
SHA1 a612ca5cee8c12285f773b42c299d44cbd08177f
SHA512 da0151875f87284e72a1a021006ad30f2809bee98cd2afc4d54fcd19a1c49f6ae1f5aecc5b9a725d96bf7c14f4f7f2b28b91009166db8b7ce8b8926ef1100d41
SSDEEP 24576:YOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:B6W+TFq6IZj8N2Y7T5GF
TLSH
T1E0F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 3d2d2a593660b1e362cb5ca6976dac6fd9334cd93d6ef5569d48653d0b46c7b1
MD5 2c8e669f584308d5592135814a0af909
SHA1 ddd81041097a5b2b691eb6a183a28ed3d4c57a0e
SHA512 714537efd95db0453226032d21b681e3455a0f54bc151fd7da450533ad1c293d59f81433978b550c6ac28b843fae7e0af49666b06da4f5ea0e5abba7fa503b15
SSDEEP 24576:UOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:16W+TFq6IZj8N2Y7T5GF
TLSH
T190F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 dae90423d96a892c483a3d4f3e2b00a83e064599f733249f6ba8e4c8bf8c8b5a
MD5 193b741665d0bafb6df0550e3f38de07
SHA1 d2605edf19ad4169feab08851f9ca911952729ed
SHA512 647fff9086c162cf2b64123818e811aeabac8ba608889a6b139702036ef74c18af107540416e51aa968999aeb1bf3d76cfe08a5bdc363dfd999cd0c562e86197
SSDEEP 24576:VOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:A6W+TFq6IZj8N2Y7T5GF
TLSH
T155F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 8dd20262ebe6264be4b6a36b58da4de73f67ac482b39a66af571acf97d222be6
MD5 70b7d053978932c7a4d08aa32994de36
SHA1 a35f175267f390021088e2b63f3b46570b9d8f4c
SHA512 4b95f983f5e38b236801a43cc935c394c59283cabcf6298e52b127ea95a0359a86a45ad6776c588be7f4095e2c21196c81d5faf77d6baf1a702e2a430bf290a7
SSDEEP 24576:8OsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:96W+TFq6IZj8N2Y7T5GF
TLSH
T1BEF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads