neconyd | 2bb2b0df62146658ea8a749386eb3e9b6585e73ec3a98359d9b2160704ac70f2

General

Target
2026-11-07_5e12098500393d5b7a44ba39df0bf4c6_elex_rhadamanthys_stop.exe
Size 64KB
Sample261108-ryhp1adv7m
SHA256 2bb2b0df62146658ea8a749386eb3e9b6585e73ec3a98359d9b2160704ac70f2
MD5 5e12098500393d5b7a44ba39df0bf4c6
SHA1 84977f9fc8a44661c9920f803dd53d8997d787d8
SHA512 543fcfc51e14048d70674459db1f2475b7c0bc73027a29dad3904aeb25c7b4a70f01c51e263307ee612c207de4785d3cf02535385f7b9ad59255adc979a85489
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:8bIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T1D9538D97B7F5803AE2630970197D888189BEBD7427F1C5CAD701488B7DB4282D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
6060	omsecor.exe
2772	omsecor.exe
5064	omsecor.exe
2396	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_5e12098500393d5b7a44ba39df0bf4c6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 6060	4436	2026-11-07_5e12098500393d5b7a44ba39df0bf4c6_elex_rhadamanthys_stop.exe	88
PID 6060 wrote to memory of 2772	6060	omsecor.exe	91
PID 2772 wrote to memory of 5064	2772	omsecor.exe	92
PID 5064 wrote to memory of 2396	5064	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-07_5e12098500393d5b7a44ba39df0bf4c6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_5e12098500393d5b7a44ba39df0bf4c6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 cae91388338d889f10b77d0b1fb0447c61c7d0525c56bcc85d97256dd1122483
MD5 a69f27f0e412e99c4f217c1b28b1fbaa
SHA1 d946c56733f6ef88ede04ed836caf1c88b74bb1e
SHA512 d5f44c3c64282aa79fb50e55918b560d02c5e053affc7fc03f64b4faa49f1b7cc67d534d11b13353989b4bc3deeae3a060848895ff81ddf7028b635deb1e805d
SSDEEP 768:ZMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:ZbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T1E9538D97B7F5803AE2630970197D988189BEBD7427F1C5CAD701488B7DB4282D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 907d4afd6b6ce2296ca00873ec515d00756bf9a5b050610585117d537c4283ff
MD5 cb48c159c1aa18d1951e61fc3eecb9a5
SHA1 ca30fbace064b2cb0377e6db5fa74c2d6f719cb2
SHA512 4ae48e1c3c66f8616122ee7ccbe488719e0d0537a6dcb052da45bdca9e9383893a2d9da127e309489b912a4084914de009e5293f4b492fb9f14151f1ee8427b3
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:8bIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T17E538D97B7F5803AE2630970197D988189BEBD7427F1C5CAD701488B7DB4282D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 51d15edb2d27eb6cdd80c3d3ab65acd4dad502055817438626e8186936689142
MD5 3699018c2bbdb394a074d77c7c37c30b
SHA1 1293903d0f0f2c1ec8fc539a4f1f31fefbe5da53
SHA512 35b05e1c489ef82d9e92a742997c0a29518f90a6a568c3f41c8f4c7d6a9c12641f3f884286cf35ba82bc6a92fdf672f2b4dabab820a10685df31287737166f4d
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:AbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T170538D97B7F5803AE2630970197D988189BEBD7427F1C5CAD701488B7DB4282D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 c2e083f095ab24654367d33861e3fe5c63d58e9b48f558177ab279a94184bac7
MD5 94ec8d49482569830672eaa57993c631
SHA1 b0f8695141e21d3cf2777e34068866a08f6dd72c
SHA512 7bf014cd492e8f32597877e4490c1eceada0b5113ee8f84925ef9efddf62b79f65f94aab5460605c052e20252ce02f09fe0be7c3a0117f7ed71024bb84769a79
SSDEEP 768:qMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:qbIvYvZEyFKF6N4yS+AQmZTl/5O
TLSH
T177538D97B7F5803AE2630970197D888189BEBD7427F1C5CAD701488B7DB4282D63BB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads