neconyd | dc25b294e721e5ec951289d21868f050b30bf18e361a9c3b230bf7ad47a293c8

General

Target
2026-11-05_734e293380e5c3a1065919162f713e66_elex_rhadamanthys_stop.exe
Size 73KB
Sample261106-y26dssew2w
SHA256 dc25b294e721e5ec951289d21868f050b30bf18e361a9c3b230bf7ad47a293c8
MD5 734e293380e5c3a1065919162f713e66
SHA1 dae2f024b8c3ac1d7dad2b43a123eee164a59c6c
SHA512 5468ae73c4a30845b2654a8c8e3273ee8bb6810f898292cc5334507316e35f4493d264bb7a33526536d04e4d7df99a3fb56baa5168363e7bc9a044dd7e11383e
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:8bIvYvZEyFKF6N4yS+AQmZTl/5
TLSH
T1D6738E97B3F5803AE2630970197D889189BEBD7427F1C6CAD70148877DB4282DA3BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
2860	omsecor.exe
4264	omsecor.exe
980	omsecor.exe
3160	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_734e293380e5c3a1065919162f713e66_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2860	716	2026-11-05_734e293380e5c3a1065919162f713e66_elex_rhadamanthys_stop.exe	89
PID 2860 wrote to memory of 4264	2860	omsecor.exe	91
PID 4264 wrote to memory of 980	4264	omsecor.exe	92
PID 980 wrote to memory of 3160	980	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-05_734e293380e5c3a1065919162f713e66_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_734e293380e5c3a1065919162f713e66_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 43118b034b6be5dad88e7303f884831e8fb7c72dd4368abfa1d1343db8241e25
MD5 cf134611c0e1b580024ca2bb038af9b5
SHA1 11e7c927ace38dc85080d2a81f1842a770f0f0c0
SHA512 075efc2a87c73eeaeeff9aa7b1c7dc0c0fb5547657cc6b2ebe17fc378fa0fe38e0c693407fab135b37014e17692e7628c34c3ecbeb8b60860f76e8994f99d790
SSDEEP 768:pMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:pbIvYvZEyFKF6N4yS+AQmZTl/5
TLSH
T126738E97B3F5803AE2630970197D989189BEBD7427F1C6CAD70148877DB4282DA3BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 080d094fd3e64f0014562df67c62697b59ee900c10728dc92c05342b4363b912
MD5 789796a95b1f0f8d486161f36d050aa3
SHA1 bdc3352ae7cfb332d9fc61869712b3bfe10f06b3
SHA512 29d43adc4363e01cf18056570b714a0fac7f0f933c3a238b1aaa49e8b29deef05995f8e1cbca8753d17071026bf724d306725fd8086c1a11ab7055ba8fad83bc
SSDEEP 768:YMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:YbIvYvZEyFKF6N4yS+AQmZTl/5
TLSH
T121738E97B3F5803AE2630970197D989189BEBD7427F1C6CAD70148477DB4282DA3BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 73KB
SHA256 e0b826ca6be20b9fd7be6b0242785025365b99879f60fbe63ec349050016cf8f
MD5 dd752ebd8a010920363556fa86992902
SHA1 8eec75177c71b159a63a48809f54bf33603c7353
SHA512 c7aa9a3202829b039b01455ca87b3371b1c12aaa199fce841b95d44bf8f0438daa4c9e719af3034b0cebc8c07868996b87a11042fff98897d06e3c398fbd3afd
SSDEEP 768:mMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:mbIvYvZEyFKF6N4yS+AQmZTl/5
TLSH
T1DF738E97B3F5803AE2630970197D989189BEBD7427F1C6CAD70148877DB4282DA3BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 73KB
SHA256 35ba907f73bb052eeb65b9d5929e095726bca3fc134fc8711346eba025c6c2a9
MD5 1f7fd5233727c6eb30fdf65cd71db617
SHA1 32d45e52285875d063cb8b073784e6670a4aa633
SHA512 9333246c3e1310e2db190c9e217d3e315f37a735a4db923da39a7fd517a801e9e470263a54ad9e310763ff87af3c2a98ca27e5275e85f01d3ca684bf1f64aae9
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:5bIvYvZEyFKF6N4yS+AQmZTl/5
TLSH
T15C738E97B3F5803AE2630970197D889189BEBD7427F1C6CAD70148877DB4282DA3BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads