neconyd | 9f45bf4d47fdf9521b2ec3e7889db72bacf2c552dd873f5f51c37beb6fb90067

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/11/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
Size 4.5MB
Sample261108-ptwpys1sgv
SHA256 9f45bf4d47fdf9521b2ec3e7889db72bacf2c552dd873f5f51c37beb6fb90067
MD5 7ad92115bb181f7c56fee5c631440fbd
SHA1 a7f5be71c51a448e261b364e22c8675850ac2a51
SHA512 68cc6cb09b144ae6f42da16eb1566b8a205035f22ecfdd6985ca901dfec62f07de4690e407f0ca81bbd46f5e66fdd8cc8e7b785cd454908af0d332063c35ea57
SSDEEP 24576:G9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:AKnuTZh8JUUyJCS9CXT8Enys
TLSH
T16C26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1748	omsecor.exe
2636	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1748	2660	2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe	84
PID 1748 wrote to memory of 2636	1748	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 4.5MB
SHA256 54ffef42f9144839d20bc7588b06a60a39e1cdc032ccf8243f359ef256ac6cea
MD5 c0bc7287bfcb0002ffb1b6c50c4b0191
SHA1 ef474e4e07d4a21a981184cfda94f0578f62e7f0
SHA512 a28a033acd6dc90a6ca41a5ba57a528563ba3d9d48121f80e7dd07da3e0a6416a04649e898c4328048890d7659a8d55d907022155e044f43cf948a8f06c71b15
SSDEEP 24576:y9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:EKnuTZh8JUUyJCS9CXT8Enys
TLSH
T19D26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download