neconyd | 5a82abd7553f8059a01a4665d6ffca918fac8fd59e26f0646e2b53ed6d3c5eb1

General

Target
2026-11-05_8b87db48ac68ec03a8805232fc1d699b_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261106-vfp8xaes2m
SHA256 5a82abd7553f8059a01a4665d6ffca918fac8fd59e26f0646e2b53ed6d3c5eb1
MD5 8b87db48ac68ec03a8805232fc1d699b
SHA1 e5f5f52924a044052aa54f2558b2bff59fc000fe
SHA512 736af2897be62a9382508bee340742b8b4ec15ff0c9a70bc277a07492d699e7bc60d5bc841445c5dca203c874372cde915fba010033c76231fee4c5db441a8fc
SSDEEP 24576:tOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:Y6W+TFq6IZj8N2Y7T5GF
TLSH
T1B0F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
1660	omsecor.exe
984	omsecor.exe
3764	omsecor.exe
3228	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_8b87db48ac68ec03a8805232fc1d699b_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1660	3508	2026-11-05_8b87db48ac68ec03a8805232fc1d699b_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	89
PID 1660 wrote to memory of 984	1660	omsecor.exe	91
PID 984 wrote to memory of 3764	984	omsecor.exe	92
PID 3764 wrote to memory of 3228	3764	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-05_8b87db48ac68ec03a8805232fc1d699b_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_8b87db48ac68ec03a8805232fc1d699b_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 2ad4218eb8f75e147357451b57dabe8472f177d098f0dd98d87f83b8e2ca4403
MD5 80c9724897e5ee9943792511e57e257a
SHA1 0a8b61d4dc6859b1a85cd916edb8dfbafe7a1713
SHA512 9c4f37799ca77f87e0b7268cfce4bf9bdaa6e0c9f9f73426e35f9988bb05cbde212da3f8f471e6885110f00d58afdd9217bf7a19df57187c05471712f7fd5294
SSDEEP 24576:kOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:F6W+TFq6IZj8N2Y7T5GF
TLSH
T141F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 e489e9c08f7ad0b4e536cfa2396574e8969a1d3bc81ce58d85595127222eba95
MD5 aa84a1942e2a3c54d16db5b15e8d8384
SHA1 bef77229a38a167ca60e35c0dcad8906da5850f8
SHA512 f68bf8b4eadb59e5e187105341d083dd45bbcd52ccc49de2d569eb49792ba5d3092eaa60004b9acc98f59ed9cebb20560393c648c1edc2af45aa12f9db7d14f4
SSDEEP 24576:FOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:w6W+TFq6IZj8N2Y7T5GF
TLSH
T1D0F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 08a0954830405c4b1fc25efbc932319db579efd1e4b8d76a290f75810965c2ea
MD5 5666e7340f97dcb9e11b64eaf72e5f30
SHA1 ff959483f0efaff31e3a2d2381773c412e038faf
SHA512 ba90dbedd303a99db4be966507f3fda472e348b36e6659097a46dcd4eb5a1fd601826059af105f5471cd6749fca8f93ab53d90b593d4bd2c2a6d4de44d9279df
SSDEEP 24576:WOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:r6W+TFq6IZj8N2Y7T5GF
TLSH
T109F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 cbe4b6299c9f5d0a23a3fd077154872ac4198e1cf8e096b17a9f8c687f41d5e1
MD5 3af20ad8c572e10604f7e6f66fb44ef6
SHA1 ba459c67d80de0bc4f36b2298ef2d4f3d978a39e
SHA512 dc9176dc123a5c4a5189b3bcda664d3f403ba4155a2329b8765267c78528be126ee55f873851b7f73820820234d846753146e1687688bbf981ef7e3f98c477de
SSDEEP 24576:IOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:x6W+TFq6IZj8N2Y7T5GF
TLSH
T182F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads