neconyd | f075e18397b1d9599de9b87fb5fff8e0f7819a43dc102305cebefa422bc837bb

General

Target
2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe
Size 65KB
Sample261111-e7qqratx6l
SHA256 f075e18397b1d9599de9b87fb5fff8e0f7819a43dc102305cebefa422bc837bb
MD5 0449997b2abd53af28699c60e07eea60
SHA1 27d565f27eff97b2719f9f2935276e3103ef1f59
SHA512 55bd74a02449852f7bc6c57dc532ff644a829466417bbb021c7ae5692d2c37cef5abdccc70c4b5b1eaaa1c8e5db455b0266142cdff8ef99bbe48a442d65518ed
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T112638D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 5 IoCs

pid	Process
4868	omsecor.exe
2196	omsecor.exe
5752	omsecor.exe
3228	omsecor.exe
2384	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4868	868	2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe	89
PID 4868 wrote to memory of 2196	4868	omsecor.exe	91
PID 2196 wrote to memory of 5752	2196	omsecor.exe	92
PID 5752 wrote to memory of 3228	5752	omsecor.exe	93
PID 3228 wrote to memory of 2384	3228	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0449997b2abd53af28699c60e07eea60_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3228
      - C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 2519c05dc7747c636e6991fe9d20180f22e22a4c31423680546970ebc9676645
MD5 4be154a26ec1534f34b2abe5e81604d5
SHA1 894149059153b8a6f483b1b1cfee8914783b93af
SHA512 f0406db1d8eca5b7655b86e239779214a3273fe2cbd5a5477760265e753708aa73b58f076fa89b211a06084bb1f00125beee6538c4a4df5a9727686357738e84
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1EB639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 89559cefd3c976762a7786a252da1b897e2dcba2379c3a9ad7357ea4d55d63ca
MD5 86f941f386b78248c4ad063d0d41f301
SHA1 301ac5017e23d72313662d5baca0e7ce3c907486
SHA512 c45e549f4119fe0649fd2d0160c72cc8d2a236d5f889775f06e2e3021ff4c77709c95aa5b850b7dc28ef403883e031aa44b58e45ebaf69e9eef9aea3eb4d0c5d
SSDEEP 1536:kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:cdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T119639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 e8f19f12c3297823de74e00ad1b06c934c43ffd7966f793a0a2ad77a4dafbd88
MD5 bc2155431f9a39000c6fd30246ff2bcc
SHA1 02313bb5e61705d500fabf815508c037a1f2a617
SHA512 57954a370f897afdd25208a3c4cbadc80ef297cb3ccd746cd600313532e9605134762dbe348883e33c54f3374b8dd9627c942b2794cc85e1f852784bc03b88e2
SSDEEP 1536:kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:cdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T11D638D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 0b628a0cfb8a9ef27c1c45f41bf759e81b974a5dfd73711a6e228b31387bd083
MD5 8452ea9e911f0e56b112060703d8c276
SHA1 e00e21433c2d212950c42b42e05549cbbe69cd21
SHA512 4d69d8b66803f21af90fcb69679c988fa4f2012651367ebafb5b71861a8550b0cc05a9176a8ec046ca844008867005226d25048ed6cc959fc29dff530832fe19
SSDEEP 1536:sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:UdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T186639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 406e92b20bca46edef310c18189cc5b9ae2c020899d33754d653107dd78804ee
MD5 e42beeadd8af818ed99b5dcc19d92931
SHA1 28eaf163a283e8dd451a69920d1802ae2f22332f
SHA512 283feb22b873eae3a8d1c6ce8b02360ea5446bc65f9b6daf3a48e3f374e9519bf5954f252ac2ce913dd2f157c1436eaf940546a06a339da119e506c70ee6ca95
SSDEEP 1536:Pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ndseIOMEZEyFjEOFqTiQm5l/5
TLSH
T114639D96B2F9C076E1A309B0657DEA91C9FEBD7416E0D1C7D7001C876EB4292C239787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads