neconyd | c1a08604dc9a973e08eec62a18af68221530eba1a0ea268e12c99f2d92c7387e

General

Target
2026-11-09_cf6586f667d569135230c2cc4eea2829_elex_rhadamanthys_stop.exe
Size 66KB
Sample261109-xbyetshe53
SHA256 c1a08604dc9a973e08eec62a18af68221530eba1a0ea268e12c99f2d92c7387e
MD5 cf6586f667d569135230c2cc4eea2829
SHA1 b900bc87d35494812dd15fd6af81066dc12db0c4
SHA512 663621088f311bf5570de11ad69fe7d65552935046a41f21904e00c5823d39cd9440a9555b5c28820f0e85fff84501f6ba98147c07f61370827a36af12c00c40
SSDEEP 1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:vdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T13D638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 5 IoCs

pid	Process
3820	omsecor.exe
2508	omsecor.exe
5356	omsecor.exe
5812	omsecor.exe
1784	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_cf6586f667d569135230c2cc4eea2829_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3820	3756	2026-11-09_cf6586f667d569135230c2cc4eea2829_elex_rhadamanthys_stop.exe	88
PID 3820 wrote to memory of 2508	3820	omsecor.exe	90
PID 2508 wrote to memory of 5356	2508	omsecor.exe	91
PID 5356 wrote to memory of 5812	5356	omsecor.exe	92
PID 5812 wrote to memory of 1784	5812	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-09_cf6586f667d569135230c2cc4eea2829_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_cf6586f667d569135230c2cc4eea2829_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5812
      - C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 66KB
SHA256 6a1c32a39f5ee58de112fd8246aeaa092aa06f894b2240262fb5e1ed4fe60e37
MD5 45302eeb5b0394b105b0e578f45e4ad0
SHA1 a518e8eff4a5e8b31dfc0cd79450d3c49ae5f20a
SHA512 9f0fe89f964c463bb2e8f2f62385bda651ce2d18ba09ff97e0301cacf5f6c9020e4c8c7a37ce3b6f390019792e402ae9127105a66fb0b5d2ee7845c9568d3bde
SSDEEP 1536:md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:edseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1AC638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 66KB
SHA256 df10aa261cc40854d11026a36655ec6c4f377957d91f4ed52898901fb09ebb68
MD5 38f1a92dfb71fad20a5deebfca0b5edf
SHA1 2a389366e141829776185c052189905a5717746a
SHA512 e98b8935ff3b60792d780a70446ba146a07f336b8a273879b09a6a33cc3dc66b087e5fc93922221c9d8cad11a15caefd4322fd1167eddb8ca06031dd5aed2ccf
SSDEEP 1536:Fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:tdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T198638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 66KB
SHA256 b1f7cee1e9de50f81c376d3ba5ff87984fe86d63f51c8d501f8d5f87ab0056de
MD5 769c97f181138ccc6801f190716185af
SHA1 551f7e43c34520f48c0bf9707e8299abaf76b1ff
SHA512 f478e68ffea8e8504f12b38a26f72d91862ac552bcec313973c13f60063204f863687a6a29d89a3ab9f94d1cdf96ca3e73a123327ccf55939876c469fa11a60b
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T14B638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 66KB
SHA256 cdef72dfe791c90617213ee16d58c372c8cfd205495acb733aeaccfedfa933dd
MD5 47babf8422abd508b3fcd3d04b8f30bb
SHA1 39191a288dafd744414f9f6334548c9aa0d3579f
SHA512 f173d00060ac3349a17b88ffd9208f90ea1b98d115a4975ec489788d00653d238125c58d20fcd8f967fa63c5b802447225e266251226f3bdcb4c5d3fd01df4a1
SSDEEP 1536:id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:SdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1A7638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 66KB
SHA256 4c93fc60e30c7ef66389dcbf8453750194c526ad6b06bf1d12e14b2c81f5bdc6
MD5 ebd2b5763ece41baf68298e3078d0d84
SHA1 6ae36a8e62380fdec89d01d1d3f86a32815659c0
SHA512 f84757617947a920ca89737bb75fc7159ace153afa519f2736a67d5ee711ffcd32c66ce33824a90333ac700f2dfe95ba2f39309e7d089816bf8cfa10ad5947d2
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:/dseIOMEZEyFjEOFqTiQm5l/5
TLSH
T166638D57B3EAC076E1A309B0267D9991C9FEBD7416E0D2CBD7001C876EB4292C639787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads