neconyd | d46b0dac7bf2d5a278468b5bdda7d0ee913de89ed9848c76d7832cef078f5f5d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/11/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261108-jd7vdshe83
SHA256 d46b0dac7bf2d5a278468b5bdda7d0ee913de89ed9848c76d7832cef078f5f5d
MD5 be24336bbd76fdcf6191cf250858b0cd
SHA1 d452bbac30026bbb7ef9d9caa82aeba46993c5ef
SHA512 43ddf921d16c196c093ac4b54b0c73e8efb4d43db7ea5239c64db1c63feff8331ec2b7088d4b860cbd60c72c2b1ae3c8086b91fb6d931c2ce1ddd9d2c37bd237
SSDEEP 24576:EOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:l6W+TFq6IZj8N2Y7T5GF
TLSH
T1B0F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
4884	omsecor.exe
3816	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4884	1224	2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	85
PID 4884 wrote to memory of 3816	4884	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 f1bc763d9353404f29cd13f5b469b39521f631821b7be4d4cb915e0c2701414f
MD5 f2492bd24da7201735943fce41043712
SHA1 dbec4436960336b9f3e11cf3c92c5df4330f9734
SHA512 4e024a1c67214fedd3ac826ae5a837fd7b3b75ff9628a0deedb0c2f9b3ba55b798616ff40725155eefbc6a7a93924736a530e6c8eedbbcc100a809bf75b60277
SSDEEP 24576:IOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:x6W+TFq6IZj8N2Y7T5GF
TLSH
T17EF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download