neconyd | 4c4ba24b67e75169f403876a8e21eb419530b69f9902d3f7fc8f1f7977638ef3

General

Target
2026-11-05_39f74aae93ed276ccf9325b2c9ef0980_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261107-er1wsadh78
SHA256 4c4ba24b67e75169f403876a8e21eb419530b69f9902d3f7fc8f1f7977638ef3
MD5 39f74aae93ed276ccf9325b2c9ef0980
SHA1 8e9ac41fe74d474daf36b36638cfd5465ff4a23f
SHA512 7556093af65d4b281c160f7b482ee04420e9a836034e4b8ba927a29a4d18a8246e1557032dabeb29b8659833d41f36eaca37758433d1675edbe3bd0ddd46ce69
SSDEEP 24576:iOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:/6W+TFq6IZj8N2Y7T5GF
TLSH
T13BF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
2532	omsecor.exe
1392	omsecor.exe
1496	omsecor.exe
356	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_39f74aae93ed276ccf9325b2c9ef0980_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 2532	3356	2026-11-05_39f74aae93ed276ccf9325b2c9ef0980_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	89
PID 2532 wrote to memory of 1392	2532	omsecor.exe	91
PID 1392 wrote to memory of 1496	1392	omsecor.exe	92
PID 1496 wrote to memory of 356	1496	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-05_39f74aae93ed276ccf9325b2c9ef0980_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_39f74aae93ed276ccf9325b2c9ef0980_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 ac229147756aa2186721faff452391fa13563f3b13ebb690c158f02da5cb1839
MD5 5dd73f3871743bcd36201c7136b13151
SHA1 8c44852303a42fb5ce57afefe93e08db99de7b4a
SHA512 bfaff2f3efacb514bc2318570f240aa6bf0a6b81617502f17963f8740f8a1e7339461ba71ee8c61c8e45c6cee28a24a8edc96a7f21694cd256c3a2a6d5da5426
SSDEEP 24576:OOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:D6W+TFq6IZj8N2Y7T5GF
TLSH
T148F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 ceda5f78842ee477fa6363ebe07ad22eb7ecb1c9adf2b1e48f1c3bf9242b580f
MD5 d4aa16a9d6dc74f57fbe49d8b4a83a4a
SHA1 9c3f434ac999193e328bfdf9f52e2502f62dc714
SHA512 fd21340488032dca2df275cc2779ec156a088e15d0e38def5983ff7c868c785a34ae67e053ad8c89d2321fe24263523e34e0fcf48b96f120b3aa218da03988e5
SSDEEP 24576:aOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:X6W+TFq6IZj8N2Y7T5GF
TLSH
T193F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 e9bdb4a547be92afd1e916b6e2bc63b69eb983a33ce2da9fee66e105dbdfc3b0
MD5 3708a10727bfb2650254af1551d799ba
SHA1 d04650b20887e4520233e51c5438156489f8df80
SHA512 8bc94a312aca413c49083215d823c1af19807e7e3ed2d2ec945833ee16a4b4047ff82ded6eda20a1198ce2fdd74ae54f722f0b0f481b4ce98f8e7d3823d7cc4b
SSDEEP 24576:oOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:R6W+TFq6IZj8N2Y7T5GF
TLSH
T1DAF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 2a04f96c5b52c275f1bd998ed6d1716e01c898c81abadde7d5fd3f1a2151b72e
MD5 a29058f61e93550683acc06a91b38e9a
SHA1 b2662415c0d29f0c5dcf61816bd26fd9cd390553
SHA512 4abbcff01f447dbd949d113359ee5797e92801e61a83a888555749c596a8c90cc82bdd62618b6063b6e8ba30ea6e61c6782ed2678d2b13af21019b65498c22d6
SSDEEP 24576:+OsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:z6W+TFq6IZj8N2Y7T5GF
TLSH
T189F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads