neconyd | 88c28e1d04b7e7dd7c2131bf5a7c1f6198357f9eb573e61daf802f3eeb9e54e0

General

Target
2026-11-07_7fdbc4e43ca974e6935127299660405b_elex_rhadamanthys_stop.exe
Size 64KB
Sample261108-pc5xaszyev
SHA256 88c28e1d04b7e7dd7c2131bf5a7c1f6198357f9eb573e61daf802f3eeb9e54e0
MD5 7fdbc4e43ca974e6935127299660405b
SHA1 8e874ececde714ce3346ae71caece089abf3cffd
SHA512 6dde5a2bf6f31db024b713eebe82e95a7bc51add41d42157ac3f4417976fbbd3c45ece1da69cf2aec5fd2abd78455e6a07ff583e5506d69c1000fefaa92619fb
SSDEEP 1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:+dseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1A2539D56B2F9C076E1A309B0697DEA91C9FEBD7416E0D1C7D3101C876EB4292C23978B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
4624	omsecor.exe
4400	omsecor.exe
4284	omsecor.exe
4396	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_7fdbc4e43ca974e6935127299660405b_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4624	4156	2026-11-07_7fdbc4e43ca974e6935127299660405b_elex_rhadamanthys_stop.exe	89
PID 4624 wrote to memory of 4400	4624	omsecor.exe	91
PID 4400 wrote to memory of 4284	4400	omsecor.exe	92
PID 4284 wrote to memory of 4396	4284	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-07_7fdbc4e43ca974e6935127299660405b_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7fdbc4e43ca974e6935127299660405b_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 d745bf9a7cceb52deb801b228f4737cc6293c112779e75ad8a16ee6f5f787960
MD5 fa72fa2fedd084263a9af583f4a24a3e
SHA1 ed2f7b8a56e0ec8fdb757c05c536f93a52a7b7ff
SHA512 5a354d997b30b8a151d2bc30da9ff94bbdd9ae1774f8194748fac5966e04cc8144291b5d6262a0063cf1f790227f13d64fea379aed68ea64850cc530897f6fe6
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:adseIOMEZEyFjEOFqTiQm5l/5
TLSH
T172539D56B2F9C076E1A309B0697DEA91C9FEBD7416E0D1C7D3101C876EB4292C23978B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 254d721b51e5e8ff4496e87221c935e028b07b66c6fdb157c5b8b13d73c1897b
MD5 57a3bcb05157ae7790c0a12a7c51abf0
SHA1 89d9f4ef48d2b579be6750f75161574a59c38f9b
SHA512 fb8384d6e9a7adad174a06223bdbbba74e0f33e7ec7d0ffbe0b6b51941b16763b98fe5b5d93e9caab769a32454a3c6d4fe010c3bf21ec9832beec955e860a317
SSDEEP 1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:idseIOMEZEyFjEOFqTiQm5l/5
TLSH
T106539D56B2F9C076E1A309B0697DEA91C9FEBD7416E0D1C7D3101C876EB4292C23978B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 b4a299f55b652dfff30d6caaa72ff9e21e13de794972c6e92d1e73eef004e347
MD5 89aa388826c60bea6e2e8087074cef92
SHA1 f7dd17ec868d18e04f7436813c864d4d1139e33e
SHA512 bf9b36f3cabaf1c4ef3925f30405a240372a6516d03de5f09ed12078cc61f89fabc28e9c06abad15aaed220b1aed0f06a0e97ac0c26a74b035abdbff88882929
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:adseIOMEZEyFjEOFqTiQm5l/5
TLSH
T119539D56B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D3101C876EB4292C23978B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 e103824018a0b3415f1b02f1b3a0f6addf94a3a7baf45f71d0a95da88900ebc3
MD5 7de6b0236d55e6475db9d69fbd2f357b
SHA1 d15e864ebd968ef06f5453dafc46c7237294a720
SHA512 ec2bd4c7e0fdf5fa1936f76562c74fafb4a5e251b19caa2235c3b301ec568762824b172b96a7f2ee3f8757f748ab0d816954de5f08f94fc4aef8652eb51954ba
SSDEEP 1536:Wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:udseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1C9539D56B2F9C076E1A309B0697DEA91C9FEBD7416E0D1C7D3101C876EB4292C23978B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads