Overview

overview

10

Static

static

10

abdedf498b...5e.exe

windows7_x64

10

abdedf498b...5e.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-09-2021 16:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    abdedf498be2483a583d52b054d3685e.exe

  • Size

    178KB

  • MD5

    abdedf498be2483a583d52b054d3685e

  • SHA1

    4cac54930e059ba7ad5fa65c24175f596fffe3f0

  • SHA256

    3f503cea0168fe927f9f93166c4d9677b39c7365c43dd0d1fafa1696889e2670

  • SHA512

    16a8bdccd9e2d597951dcdf123146cf17fc8472cdeca5ef911b9603ed020b378cefb209aa12b50e5ac0616d4a5e0beb805cde92ccb45c0309850d7ec577a0c02

Score
10/10
asyncratneshtapersistenceratspywarestealer

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Detect Neshta Payload 46 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Async RAT payload 4 IoCs
    rat
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abdedf498be2483a583d52b054d3685e.exe
    "C:\Users\Admin\AppData\Local\Temp\abdedf498be2483a583d52b054d3685e.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Users\Admin\AppData\Local\Temp\3582-490\abdedf498be2483a583d52b054d3685e.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\abdedf498be2483a583d52b054d3685e.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runhost" /tr '"C:\Users\Admin\source\runhost.exe"' & exit
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn runhost /tr '"C:\Users\Admin\source\runhost.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn runhost /tr '"C:\Users\Admin\source\runhost.exe"'
            5⤵
            • Creates scheduled task(s)
            PID:2464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCECF.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:2180
        • C:\Users\Admin\source\runhost.exe
          "C:\Users\Admin\source\runhost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:412

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/412-178-0x000000001B292000-0x000000001B294000-memory.dmp

    Filesize

    8KB

    Download

  • memory/412-177-0x000000001B290000-0x000000001B292000-memory.dmp

    Filesize

    8KB

    Download

  • memory/412-179-0x000000001B294000-0x000000001B295000-memory.dmp

    Filesize

    4KB

    Download

  • memory/964-119-0x000000001B090000-0x000000001B092000-memory.dmp

    Filesize

    8KB

    Download

  • memory/964-117-0x0000000000440000-0x0000000000441000-memory.dmp

    Filesize

    4KB

    Download