neconyd | d46b0dac7bf2d5a278468b5bdda7d0ee913de89ed9848c76d7832cef078f5f5d

General

Target
2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261108-jd7vdshe83
SHA256 d46b0dac7bf2d5a278468b5bdda7d0ee913de89ed9848c76d7832cef078f5f5d
MD5 be24336bbd76fdcf6191cf250858b0cd
SHA1 d452bbac30026bbb7ef9d9caa82aeba46993c5ef
SHA512 43ddf921d16c196c093ac4b54b0c73e8efb4d43db7ea5239c64db1c63feff8331ec2b7088d4b860cbd60c72c2b1ae3c8086b91fb6d931c2ce1ddd9d2c37bd237
SSDEEP 24576:EOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:l6W+TFq6IZj8N2Y7T5GF
TLSH
T1B0F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
4524	omsecor.exe
248	omsecor.exe
4692	omsecor.exe
1784	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4524	4952	2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	90
PID 4524 wrote to memory of 248	4524	omsecor.exe	92
PID 248 wrote to memory of 4692	248	omsecor.exe	93
PID 4692 wrote to memory of 1784	4692	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_be24336bbd76fdcf6191cf250858b0cd_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 0253015d14d041005ce72c0b6ccd0eb176b48c4bc18589e6a28906f1dd10b93a
MD5 b46e237d6b4e1d54201f2c9d6c16f420
SHA1 90383a00116d0e7025a19207001b53957ea0e1e8
SHA512 e26ffc0f086068437c2d7dcaccda988d0f80583e5d63cb3c9172b42b2f1f6a36d0aff77df13e8022ed74c2315e6804d168a55d5a93487673e8646ac6087b5fd1
SSDEEP 24576:fOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:G6W+TFq6IZj8N2Y7T5GF
TLSH
T105F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 f1bc763d9353404f29cd13f5b469b39521f631821b7be4d4cb915e0c2701414f
MD5 f2492bd24da7201735943fce41043712
SHA1 dbec4436960336b9f3e11cf3c92c5df4330f9734
SHA512 4e024a1c67214fedd3ac826ae5a837fd7b3b75ff9628a0deedb0c2f9b3ba55b798616ff40725155eefbc6a7a93924736a530e6c8eedbbcc100a809bf75b60277
SSDEEP 24576:IOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:x6W+TFq6IZj8N2Y7T5GF
TLSH
T17EF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 a820d25bb1134fc2b3fb0dc788dc17ba8d6385558e78eabab18df7c3fd1ba060
MD5 5aaacc2a07d912b7ed6e91f361f6c1b7
SHA1 a8856451e1289d74694edb0eef078481f70a7b19
SHA512 4e3f718cd1f079f621f66cace82d20a7cc9b50d492d1a0ca456717cdf4642fcc478571f1cb326a91060bf5d25341f1f85f40a76f7a9151281a4c66a2dca4b6dd
SSDEEP 24576:uOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:j6W+TFq6IZj8N2Y7T5GF
TLSH
T119F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 e65c9a9ca18d436551dfd4b01ad4a6404b8cce70c0adfbe158bfee4ebfd0edf7
MD5 dce2863f4b2ad3a7fadab64d3dc202a7
SHA1 b53b01d3b23a22fe572a168436ad6f426857b94c
SHA512 f38e91405a3672e4bc61150a66d8a0c54ee86463615822c43ec5bb82da23f81b35b271780ebef14faafdeaeb3eda63f48fe8f834df441d9e4854d91bef4b1f01
SSDEEP 24576:LOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:K6W+TFq6IZj8N2Y7T5GF
TLSH
T102F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads