neconyd | adeb6ce525b1fc0b9606c79250dcba2efae49c5d411a018abbffb91fa9a2744f

General

Target
2026-11-05_2aeb8eb5ef6eb0b3734093dfa22102c0_elex_rhadamanthys_stop.exe
Size 69KB
Sample261107-graeyaa14k
SHA256 adeb6ce525b1fc0b9606c79250dcba2efae49c5d411a018abbffb91fa9a2744f
MD5 2aeb8eb5ef6eb0b3734093dfa22102c0
SHA1 0159a8b4484715c5c11d7ba699c7028e2b72e7b7
SHA512 78fb71ef639e93319f769c94d283ae577f4019cad94b07fa07f993bad99d5d54f4ca336f047d99234ae240078b08fab02a5db5001166cb7cb43467e029cb5585
SSDEEP 768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:IbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T1B3638EA7B7F5803AE2630970197D889189BEBD7427F1C6CAD701484B7DB4281D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
4128	omsecor.exe
3340	omsecor.exe
5948	omsecor.exe
1180	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_2aeb8eb5ef6eb0b3734093dfa22102c0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 4128	5708	2026-11-05_2aeb8eb5ef6eb0b3734093dfa22102c0_elex_rhadamanthys_stop.exe	90
PID 4128 wrote to memory of 3340	4128	omsecor.exe	93
PID 3340 wrote to memory of 5948	3340	omsecor.exe	94
PID 5948 wrote to memory of 1180	5948	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-05_2aeb8eb5ef6eb0b3734093dfa22102c0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_2aeb8eb5ef6eb0b3734093dfa22102c0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 69KB
SHA256 7119f9a932dffed69f4c1e5a06f9eb1b890564de94f7b417b7a2462576d6c4c6
MD5 16c3d750a2e716c62efdce3f4b523d1f
SHA1 6e5da405e53c61e840e4ed4c9832f85500466f47
SHA512 4b559afcd6df7b003e06e0ed13e2435974427cb886c06f0348df57bcd977be4e749d0fdba5487239a4a9c07fdf0c57e2dc950a292dbe84205ae9367eb8cb44b0
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T198638E97B7F5803AE2630970197D889189BEBD7427F1C6CAD701484B7DB4281D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 69KB
SHA256 60cb6af240355c6fd8a9bcb4d2c60f3fd03a0259d4e26a699207e1ce90e8ef8c
MD5 990754f12c1aeffd12c5e5e6b2532e79
SHA1 72511d4cb7bebf7bd2c99699a76b405b5dbe39fd
SHA512 5d9e4e77d3aa102adfba76d76cd2825c59e37ef41c6d052d31c01d6d5c7abfc943a6cbdf6b71d2c3acd7665630d56d61e846912b11ad316bff7f5e739fb2b6fa
SSDEEP 768:wMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:wbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T18F638EA7B7F5803AE2630970197D889189BEBD7427F1C6CAD701484B7DB4281D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 69KB
SHA256 9f57c610f0d1fa7245e8ef0b1ff84cdddb48fc4b0ae8b5afadfbb7b2813ba0f3
MD5 36b29651ec70ea11028fe3ccc22b96d0
SHA1 b2455d003e44035e61fe1ceb25f19504128ce9db
SHA512 55b77a8ed98c0707488578439ee0bbacf1ef23a1977276af4aae139286945f8c3de121d24b3238989f54461e73c7e01d628f27674f41eb8d01975af4abc676be
SSDEEP 768:yMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:ybIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T1A8638E97B7F5803AE2630970197D889189BEBD7427F1C6CAD701484B7DB4281D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 69KB
SHA256 92324ed416a88c8d05bccf0cddaab7efb746bb93dfd3729d3815853ed0b8f0c2
MD5 7bebac38695b022937aec7a0a01b6de6
SHA1 4530d3ab969c60b7eb6e66a1c74865c302ee02b7
SHA512 034b5a8bc57348ec42125d4befbed3e877a95aa053713f3def069344c6393eea30797a81929a0b43a3cc6a5553b0224e33bcc47eab78e414908a9f252ae41661
SSDEEP 768:pMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:pbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T1E9638EA7B7F5803AE2630970197D889189BEBD7427F1C6CAD701484B7DB4281D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads