neshta | d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358

General

Target

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
Size

444KB
MD5

a62aa723f5e39dbcd27d3e3437d93ea1
SHA1

e93b8907067bb9453218411e06396d53f689ada4
SHA256

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358
SHA512

627f34686a9d17de881e603d8c33f5b599d5a3cfc3ebec579dd0b723bcd9c4d2db0af75a21de8c16e8ade6ddf79cde2fd10983aabff73bb8c9fbdf1b0d6c7086

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

pid process

828 d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
828	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

Drops file in Program Files directory 53 IoCs

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

Drops file in Windows directory 1 IoCs

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description ioc process

File opened for modification C:\Windows\svchost.com d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3568 828 WerFault.exe d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

pid	pid_target	process	target process
3568	828	WerFault.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

Modifies registry class 1 IoCs

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3568 WerFault.exe
Token: SeBackupPrivilege 3568 WerFault.exe
Token: SeDebugPrivilege 3568 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3568	WerFault.exe
Token: SeBackupPrivilege	3568	WerFault.exe
Token: SeDebugPrivilege	3568	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

description	pid	process	target process
PID 3136 wrote to memory of 828	3136	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
PID 3136 wrote to memory of 828	3136	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
PID 3136 wrote to memory of 828	3136	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe	d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe

C:\Users\Admin\AppData\Local\Temp\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
"C:\Users\Admin\AppData\Local\Temp\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\3582-490\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe"
2⤵
- Executes dropped EXE
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1108
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
MD5
e76d0269920dada1bb0d4fcf5393081b

SHA1
02f835622a9066da1ae8cfe05e5c382b735d926e

SHA256
d418bcf98881b622024a3ae7084add709e3abd8fd566aee5c12c4567eb66a9d4

SHA512
45027e056e23d1c631fbb12d182f2b29a4f91c2b87b9379b1a48d1858cde4c55508f5808a46e15f630fdfec8ea4e661007364d7d13c4800cd21111dd1918c0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\d4a923a1936f1ac5072883d118067f8ccda80e702d1593e5b7cdcd2b18915358.exe
MD5
e76d0269920dada1bb0d4fcf5393081b

SHA1
02f835622a9066da1ae8cfe05e5c382b735d926e

SHA256
d418bcf98881b622024a3ae7084add709e3abd8fd566aee5c12c4567eb66a9d4

SHA512
45027e056e23d1c631fbb12d182f2b29a4f91c2b87b9379b1a48d1858cde4c55508f5808a46e15f630fdfec8ea4e661007364d7d13c4800cd21111dd1918c0ad

Download Submit
memory/828-115-0x0000000000000000-mapping.dmp

Download
memory/828-118-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/828-120-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/828-121-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/828-122-0x0000000005520000-0x0000000005A1E000-memory.dmp

Filesize
5.0MB

Download
memory/828-123-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads