neconyd | 9f45bf4d47fdf9521b2ec3e7889db72bacf2c552dd873f5f51c37beb6fb90067

General

Target
2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
Size 4.5MB
Sample261108-ptwpys1sgv
SHA256 9f45bf4d47fdf9521b2ec3e7889db72bacf2c552dd873f5f51c37beb6fb90067
MD5 7ad92115bb181f7c56fee5c631440fbd
SHA1 a7f5be71c51a448e261b364e22c8675850ac2a51
SHA512 68cc6cb09b144ae6f42da16eb1566b8a205035f22ecfdd6985ca901dfec62f07de4690e407f0ca81bbd46f5e66fdd8cc8e7b785cd454908af0d332063c35ea57
SSDEEP 24576:G9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:AKnuTZh8JUUyJCS9CXT8Enys
TLSH
T16C26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 5 IoCs

pid	Process
4236	omsecor.exe
4780	omsecor.exe
4856	omsecor.exe
3988	omsecor.exe
3196	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4236	1456	2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe	89
PID 4236 wrote to memory of 4780	4236	omsecor.exe	91
PID 4780 wrote to memory of 4856	4780	omsecor.exe	92
PID 4856 wrote to memory of 3988	4856	omsecor.exe	93
PID 3988 wrote to memory of 3196	3988	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7ad92115bb181f7c56fee5c631440fbd_coinminer_elex_glassworm_njrat_rhadamanthys_stop_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3988
      - C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 4.5MB
SHA256 07d6d5b3a4d596550278a20d156b83fa0840c245c0dac952f8a740073a893a03
MD5 5a7284ff8c214188e4f6e2304fb9c989
SHA1 a28c4adc4894780db6f7b596df5cc9fb9f8a29bc
SHA512 05b5fd3105f4b504cf72edb39ed81aa59dd714f748ea3991d015d198a461fafc541a546d4ccb58b6a7d44cd67c116f67c8c1d281977c3ffc68ac55e1571617cc
SSDEEP 24576:y9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:EKnuTZh8JUUyJCS9CXT8Enys
TLSH
T1A326A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 4.5MB
SHA256 f70e60148de4c703f9448be6b8e6ae05c4063a397e14a67e76956aa541b77ac9
MD5 9d6944fc959f4cac315ba31df6bd7f72
SHA1 9a2a2f9b984321a44dc57077ad7f5aab046a2681
SHA512 fe8fb5e26334b81356a30ca6b935a2e243d68fd712a71451aaf46b9a6e35670964fe8b805d54af4533372ae3cbe86de2b206563e569e704f44f15b0158d20c83
SSDEEP 24576:K9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:sKnuTZh8JUUyJCS9CXT8Enys
TLSH
T14426A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 4.5MB
SHA256 54ffef42f9144839d20bc7588b06a60a39e1cdc032ccf8243f359ef256ac6cea
MD5 c0bc7287bfcb0002ffb1b6c50c4b0191
SHA1 ef474e4e07d4a21a981184cfda94f0578f62e7f0
SHA512 a28a033acd6dc90a6ca41a5ba57a528563ba3d9d48121f80e7dd07da3e0a6416a04649e898c4328048890d7659a8d55d907022155e044f43cf948a8f06c71b15
SSDEEP 24576:y9Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:EKnuTZh8JUUyJCS9CXT8Enys
TLSH
T19D26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 4.5MB
SHA256 edc183b6c918f90bf09923f88ede8e9baea9cf3947ce9906e184ef56e60f4309
MD5 766065b8f08f5c6f7b3f137c0d4b4d77
SHA1 fd2a571ed5f635dd6a88e2f1905491a71c45360e
SHA512 5caed402ed32b102899a70884708c76ff146b8224711994f4087bb909042be0d206dc604abf5df391d81fd847cddc6535dd9cb7f907b705dd6d5cf773e93c16d
SSDEEP 24576:99Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:DKnuTZh8JUUyJCS9CXT8Enys
TLSH
T1EA26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 4.5MB
SHA256 f40b8343c053415878051a624a48cf7c618e64b9da6746c464e8b036775e3351
MD5 c30bfaa64828195c52cf9be972f2000b
SHA1 c8a7805a477ccb3087849cfce5d12d5528552ce2
SHA512 d3a4e3f33dce3d100090de7983dac218f3937f2470f267f5b175655c23f093f3db4223dab0702be055dff690420fdaff2f6463cb18e0242a0723924dfd6217e4
SSDEEP 24576:29Z9yn0hTZrIbAEu8CkB7mA5yupIIKQS9YRXT8HU/ny5U5DB:QKnuTZh8JUUyJCS9CXT8Enys
TLSH
T19A26A30173F98995F2F36B309EF5C2555B3ABCA59EB2C62E3144428D0D76A50EE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads