neshta | 16cb5498c592fb2a32fa882aa0996591f067d77c50eedf69cda4d04ef93cab83

General

Target

DUE SOA.exe
Size

614KB
MD5

e6839a4ad6eb043bd41052740c27e1f9
SHA1

a03ab63f5c070980be362d3b98bdd55f2574c228
SHA256

16cb5498c592fb2a32fa882aa0996591f067d77c50eedf69cda4d04ef93cab83
SHA512

2524dc118ccbaf7c5bdd462d460e15e7eafeab3cd5a67fdde591fccb5a8a1c6394e3cdec17e9c8fd2a1a9e1861792ce86f1f5c42a2d8f197a278b075559aa19e

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Detect Neshta Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1500-57-0x0000000000000000-mapping.dmp	family_neshta
behavioral1/memory/1500-58-0x00000000001C0000-0x00000000001DB000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Loads dropped DLL 1 IoCs

Processes:

DUE SOA.exe

pid process

1720 DUE SOA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

688 1500 WerFault.exe DUE SOA.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

688 WerFault.exe
688 WerFault.exe
688 WerFault.exe
688 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

688 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 688 WerFault.exe

pid	process
1720	DUE SOA.exe

pid	pid_target	process	target process
688	1500	WerFault.exe	DUE SOA.exe

pid	process
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe

pid	process
688	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	688	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

DUE SOA.exeDUE SOA.exe

description	pid	process	target process
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1720 wrote to memory of 1500	1720	DUE SOA.exe	DUE SOA.exe
PID 1500 wrote to memory of 688	1500	DUE SOA.exe	WerFault.exe
PID 1500 wrote to memory of 688	1500	DUE SOA.exe	WerFault.exe
PID 1500 wrote to memory of 688	1500	DUE SOA.exe	WerFault.exe
PID 1500 wrote to memory of 688	1500	DUE SOA.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DUE SOA.exe
"C:\Users\Admin\AppData\Local\Temp\DUE SOA.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\DUE SOA.exe
"C:\Users\Admin\AppData\Local\Temp\DUE SOA.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 148
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:688

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiF603.tmp\snivhltj.dll
MD5
0810741d83c6146718c3c17119879b1a

SHA1
298d046f6f0ced5a60ba173847891e61018f34ae

SHA256
b237eb4878a416ce0dced719586e3a571aa482b792840a2010291e045e99f68e

SHA512
23a945c1934299a6753eb4f4f258a8b06c41b0a679128d9821bbed9ebe587efa0a66acdd670cb4b51b05099cf14e5b92d1e15cb2c54dd1536dadc3c824eb1ba6

Download Submit
memory/688-67-0x0000000000000000-mapping.dmp

Download
memory/688-69-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1500-57-0x0000000000000000-mapping.dmp

Download
memory/1500-58-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1500-62-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1720-55-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing