neconyd | f075e18397b1d9599de9b87fb5fff8e0f7819a43dc102305cebefa422bc837bb

General

Target
2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe
Size 65KB
Sample261111-e7qqratx6l
SHA256 f075e18397b1d9599de9b87fb5fff8e0f7819a43dc102305cebefa422bc837bb
MD5 0449997b2abd53af28699c60e07eea60
SHA1 27d565f27eff97b2719f9f2935276e3103ef1f59
SHA512 55bd74a02449852f7bc6c57dc532ff644a829466417bbb021c7ae5692d2c37cef5abdccc70c4b5b1eaaa1c8e5db455b0266142cdff8ef99bbe48a442d65518ed
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T112638D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 5 IoCs

pid	Process
4832	omsecor.exe
4836	omsecor.exe
888	omsecor.exe
3200	omsecor.exe
3976	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4832	3688	2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe	85
PID 4832 wrote to memory of 4836	4832	omsecor.exe	95
PID 4836 wrote to memory of 888	4836	omsecor.exe	96
PID 888 wrote to memory of 3200	888	omsecor.exe	97
PID 3200 wrote to memory of 3976	3200	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3200
      - C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 55558d8c4fc06d60a8aa03170f1d2724fb54b58466b35180dc5d6a3e9e76b92d
MD5 af884a942d99fd58082044a6abc6563c
SHA1 6aae8d8ef481a6578c99c4bb6a64d138d2fa4328
SHA512 dbd74cb645fd891e2f9824b084fd40cdd9260c82f2d278fba3a3ee4f85ba9100f5b4f58a95a8326d257b7640c22ef136a01b1692c6c811b1822574e12887024f
SSDEEP 1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:CdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1A0639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 e921c32eecc0cdc411d482cf5890b5beb9961ec8febb93f57bbb66a7535bc444
MD5 80100b9818ed585e58abf0673cc302c5
SHA1 7b4291e07b508061e7047727b44fbec452aa2337
SHA512 153784b131dec012d24e3b0ffe75eafa3e2f8380b80cd4f601ca7e32271981a42e1608bcb1c267e249325c578eb046a0c62aa451208ab551a0f4c5eecbef1961
SSDEEP 1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:mdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1AF639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 e8f19f12c3297823de74e00ad1b06c934c43ffd7966f793a0a2ad77a4dafbd88
MD5 bc2155431f9a39000c6fd30246ff2bcc
SHA1 02313bb5e61705d500fabf815508c037a1f2a617
SHA512 57954a370f897afdd25208a3c4cbadc80ef297cb3ccd746cd600313532e9605134762dbe348883e33c54f3374b8dd9627c942b2794cc85e1f852784bc03b88e2
SSDEEP 1536:kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:cdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T11D638D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 5c673d7beed30ef7688729c05ea9f0a2644579d46962ab0bce3ea8e782b253d9
MD5 95a8e109fff5c6687e65511304d13766
SHA1 07293599d0e190514231f4ee9939e5509169ca09
SHA512 b42664965faa25ba7da1285858d2ec204fbd8bb0bd5a49130f04abc22521fe2aa873ce9d93c7a5a926eacded3e98fc6d6c7f0f23403d46bf2f39b32b46fe2f9c
SSDEEP 1536:ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:6dseIOMEZEyFjEOFqTiQm5l/5
TLSH
T111639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 5bc547909dbc0c821cff59a93610d4ed0e75dffdf5eff0e06949c8e214a399c0
MD5 f864e50b012004386d1a6a4b6bb6a675
SHA1 63ddffab80b49ef229fe2a8471d6fdaa246750d4
SHA512 2248ff2b03ac3be8ab15bc72ffda265c5fa2090340f69bfe69da9ee6b5f64dc9978a1269ca66d452d1a01f9716c934b1c62d5b7f9d8867d85ac0e6da98f53613
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1AC639D96B2F9C076E1A309B0697DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads