neconyd | c0e74361e405a0e7b7f0fe044ae8b47d0ade9b72b28f65bbebf952991953cc63

General

Target
2026-11-09_9c593227af47e5b6c4069327195c4b8b_elex_rhadamanthys_stop.exe
Size 66KB
Sample261109-26zzcswvgw
SHA256 c0e74361e405a0e7b7f0fe044ae8b47d0ade9b72b28f65bbebf952991953cc63
MD5 9c593227af47e5b6c4069327195c4b8b
SHA1 964c5cb392a7255bd96e15c7577911ef26407427
SHA512 43adaceb970fbf68fe1bbe938810aeda4a052ba11f61c8ad178a7567dbe1a4a8ed4be7914d6c09f3b70de62ab79e3f3a9674a0bdeebd69a33db275621de24810
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:IdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T186638D97B3E9C076E1A309B0657D9A91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
944	omsecor.exe
5624	omsecor.exe
5284	omsecor.exe
2428	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_9c593227af47e5b6c4069327195c4b8b_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 944	476	2026-11-09_9c593227af47e5b6c4069327195c4b8b_elex_rhadamanthys_stop.exe	88
PID 944 wrote to memory of 5624	944	omsecor.exe	90
PID 5624 wrote to memory of 5284	5624	omsecor.exe	91
PID 5284 wrote to memory of 2428	5284	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-09_9c593227af47e5b6c4069327195c4b8b_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_9c593227af47e5b6c4069327195c4b8b_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 66KB
SHA256 a32aae9e54c71a4c3fa388020c55843980988c604c5a8597386ab3c133e32161
MD5 db09b9a3b18d31e76ff14a74f0d16983
SHA1 31de4193070b17998411c0fee94a9760a91c7767
SHA512 6bfa9e104025cdaf710d5ccb09a9f94dfc7675ae569140651827bade188bf834e88ce004007da9eb1e30baf9817f1c1cbe465c560d19f05d63e919e5415cca52
SSDEEP 1536:Fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:tdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1D1638D97B3E9C076E1A309B0657D9A91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 66KB
SHA256 964bc0e066da424dcaccd8244f875836f1b8ee26420778dbd005c7d4348c3bfb
MD5 513626487b195ac5105c039122aa7162
SHA1 591b58cbd82cb381617869b0f5f014459fafc873
SHA512 cfc24c405ca3d5dd4d1cc75b422f25e386912d432324a0c70f0dd9575d4ecc29077e4e83868601ec210e581ae028058ea718d705fa10da4b7830e1b80de0143c
SSDEEP 1536:wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:wdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T142638D97B3E9C076E1A309B0657D9A91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 66KB
SHA256 c8807b0e58637925a753cd5d400ca56cd8b5eab6213b9ae843ae819b48ca10ba
MD5 17247a2cc77b98655ecebe1cf9632ba1
SHA1 462a37e353e46eefb8e84f5e866b5e6bce7b3c8a
SHA512 74a7746c60eeda639c81b33ec0572aa6d06d080e835408b6fdcee623cc137ebc1e431f34eca17c694b6f5af55deb5767450ee5d936ae546216c685b8baa6de86
SSDEEP 1536:gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:AdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T197638D97B3E9C076E1A309B0657D9A91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 66KB
SHA256 e1eacb70a983aadc69b916f9f0d2e591e7818a9f2aa0d16c66e8c983785592cd
MD5 f1eee719f0ec315f4d2e6c67a6ffdb25
SHA1 52002725f4fd14d24c8043c8a8e72723288109de
SHA512 0777f0ad2e4e71ce5f59245d7c5433ccaca55b158e869a3133c2a381e8d3ead262ca6ff9dcf3e5b2b0b2954c5cbb68979ac81d82f6a55f45ba30be86314bfc22
SSDEEP 1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:1dseIOMEZEyFjEOFqTiQm5l/5
TLSH
T18D638D97B3E9C076E1A309B0657D9A91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads