neconyd | e221a7fb09854087996a1dabf33b1ce8f46051b90e98b447121ea422bc6e9c3b

General

Target
2026-11-10_d890351191309fb915f40e54478e1a92_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Size 3.2MB
Sample261111-w43dtabb89
SHA256 e221a7fb09854087996a1dabf33b1ce8f46051b90e98b447121ea422bc6e9c3b
MD5 d890351191309fb915f40e54478e1a92
SHA1 3a015bff4ac1799df9d9ae7ac97f1ac413872e88
SHA512 43600e1e1f2194abaea6e67071bc4121c68667c1c3d27ad45aba17b6a9a46099377acc0c234c06d5e64c33adf89cf9422885bb6964826a0e3bee7b3375492cb7
SSDEEP 24576:wOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:Z6W+TFq6IZj8N2Y7T5GF
TLSH
T1FDF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neconyd trojan

Malware Config

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 4 IoCs

pid	Process
2784	omsecor.exe
5952	omsecor.exe
5428	omsecor.exe
3808	omsecor.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omsecor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_d890351191309fb915f40e54478e1a92_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2784	4800	2026-11-10_d890351191309fb915f40e54478e1a92_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe	89
PID 2784 wrote to memory of 5952	2784	omsecor.exe	91
PID 5952 wrote to memory of 5428	5952	omsecor.exe	92
PID 5428 wrote to memory of 3808	5428	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-10_d890351191309fb915f40e54478e1a92_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_d890351191309fb915f40e54478e1a92_coinminer_elex_glassworm_icedid_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 cef62da75abcd763b08d70b18d4477f724b6852955b2f820b2eb9db009cea6e7
MD5 c1f6c5e4a8c4232159a0a604054254e3
SHA1 fb63d7acddfe8fc9845e8c6f530d73421a54b2cf
SHA512 8b46605828b33a8f868f4a5690b3e9f092b05b63d62c40d2b462b4bf1c3779a2c370d161d6d49dc2d0c08111dc2454026d6161aa2154a718b3d3daa2ef3f4de6
SSDEEP 24576:vOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:W6W+TFq6IZj8N2Y7T5GF
TLSH
T198F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 3.2MB
SHA256 e55f0a509a9d8449ef3d6f0385fc70d35c7aa2443e7d4bbdc88a96fdc15a65c4
MD5 454e49be02ee5dfbb5b004524fba70af
SHA1 5136429e7f5bf4bb808ee037459955a0afb5dca5
SHA512 e1ccb61eb61e1719893a37e8999e591c8a558fb087cabf38874fd7ec12581faedc5319241bee3c51c83722cfcdce95936ae95724262932a8a6d984b54eb3da28
SSDEEP 24576:sOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:t6W+TFq6IZj8N2Y7T5GF
TLSH
T14CF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 568b9c39eb81f7a24411efa7b06434fe81d92ec24128cf591db92df4626d80d5
MD5 eecbe5e8821e94e06aa0801c0f6af005
SHA1 138b86e59131a16c1b51a221899943fbdeb06aac
SHA512 d07d7945e72e95e9820888386f1d3bc082efc5b2df40539ba9739e3f9c8fe187b7a74a83cd72ecebc6fa7a40970c61c9795a37c244c36ce82df43595778ca64c
SSDEEP 24576:sOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:t6W+TFq6IZj8N2Y7T5GF
TLSH
T18DF5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 3.2MB
SHA256 9b7e2aaa2270f3199946d4587d58a42bb56423413b5a38a9f66eeb1b1fab1d34
MD5 dbde4e2783cc576d2a4e786b7d082e67
SHA1 fbd73e35cad7bfc1e5ba04c31e9eb45358f64257
SHA512 7d18566ed2ca405fcc3d99444609dec8aaba64c28b66b09adc6f843f2694e510c065121507a64148d070f7a63caffcb9dfdaf4923323443cc5e156cb12e99d2e
SSDEEP 24576:rOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB:q6W+TFq6IZj8N2Y7T5GF
TLSH
T176F5911163F90995F6F32F30ADF481155B3ABCA9A9F6C62D3244418E1DB6A50FE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads