Resubmissions

14-09-2021 09:52

210914-lv85wsaebj 10

09-07-2021 18:31

210709-dplxbpw8y2 10

Analysis

  • max time kernel
    72s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-07-2021 18:31

General

  • Target

    bf4ca3ef810bbc866015723e09cdfb7b.exe

  • Size

    476KB

  • MD5

    bf4ca3ef810bbc866015723e09cdfb7b

  • SHA1

    b1ef1b47cb790ee88866d31bb09929a516e36caf

  • SHA256

    70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005

  • SHA512

    1fdac4d5fc922265871ac741fb3241e28307e6c52297e515e8e5aaeb85c9fb2c88183a3a0f080c4ae9e53e1553064d9308a74b5888b8c42f813e395c09aa45b8

Malware Config

Signatures

  • Detect Neshta Payload 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 55 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
    "C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
      C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
      2⤵
        PID:980
      • C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
        C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
        2⤵
          PID:1480
        • C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
          C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe
          2⤵
          • Modifies system executable filetype association
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          PID:1280

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Change Default File Association

      1
      T1042

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1280-128-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

      • memory/1280-129-0x00000000004080E4-mapping.dmp
      • memory/1280-130-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

      • memory/3728-114-0x0000000000430000-0x0000000000431000-memory.dmp
        Filesize

        4KB

      • memory/3728-116-0x0000000005360000-0x0000000005361000-memory.dmp
        Filesize

        4KB

      • memory/3728-117-0x0000000004D20000-0x0000000004D21000-memory.dmp
        Filesize

        4KB

      • memory/3728-118-0x0000000004E60000-0x000000000535E000-memory.dmp
        Filesize

        5.0MB

      • memory/3728-119-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
        Filesize

        4KB

      • memory/3728-120-0x00000000068D0000-0x0000000006931000-memory.dmp
        Filesize

        388KB

      • memory/3728-121-0x00000000069C0000-0x00000000069C1000-memory.dmp
        Filesize

        4KB

      • memory/3728-122-0x0000000005080000-0x0000000005081000-memory.dmp
        Filesize

        4KB

      • memory/3728-127-0x00000000075A0000-0x0000000007602000-memory.dmp
        Filesize

        392KB