elivoncoder
There are several ways you could try to search for the culprit.
The least invasive one I can think of is to remove network permission one app at a time and rescan your device, until you get the port as closed.
If you didn't already, try to scan your device using root (if unix like OS) or Administrator/System (if Windows) from your pc, and use the option -sS, which basically ask nmap to not finish the entire tcp handshake (it will send only the SYN packages and wait for replies) and the option -sV to try to enumerate the service behind the port.
While you don't have any firewall to elude, sometimes this leads you to better results (and less traffic overall).
Versioning (especially for OSes) and SYN scan are not available for non-root users.
Also, the echo protocol on port 7/TCP is a very old thing, probably there is some misconfiguration somewhere (?)
I would try to perform more scans to make sure it is not exposing knwon vulnerabilities.
If we still have to use nmap I would try something like:
nmap -p 7 --script banner <target> (to check if echo is actually running as intended)nmap -p 7 --script vuln <target> (which is a very generic way to ask nmap if some known vuln is present for that port)
You already skipped adb (5555/TCP), so no need to check for that, but I would still try something like: nmap --script broadcast-* to see if the smartphone is broadcasting something.