neshta | 234de00e0baf6411e8b774d7821ce00a06ae9d09599f4dbc32b1367493130707

General

Target

62,500-payment............exe
Size

275KB
MD5

6f9a435a8d01482b3a8fbdcd361f277b
SHA1

fa6abbaa9eab006f1d6b464a29c11ca88c35d8bb
SHA256

234de00e0baf6411e8b774d7821ce00a06ae9d09599f4dbc32b1367493130707
SHA512

b310ae7d0c069c93c7843d0374815c923e5bb970d133813c0a302e102f36368ff46f7d0d599028c226bd4f6ab8df52066ddf40b73a0f128b6ced55f84e1b2579

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Detect Neshta Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1468-57-0x0000000000000000-mapping.dmp	family_neshta
behavioral1/memory/1468-58-0x00000000001C0000-0x00000000001DB000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Loads dropped DLL 1 IoCs

Processes:

62,500-payment............exe

pid process

1584 62,500-payment............exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1056 1468 WerFault.exe 62,500-payment............exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1056 WerFault.exe
1056 WerFault.exe
1056 WerFault.exe
1056 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1056 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1056 WerFault.exe

pid	process
1584	62,500-payment............exe

pid	pid_target	process	target process
1056	1468	WerFault.exe	62,500-payment............exe

pid	process
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe

pid	process
1056	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1056	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

62,500-payment............exe62,500-payment............exe

description	pid	process	target process
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1584 wrote to memory of 1468	1584	62,500-payment............exe	62,500-payment............exe
PID 1468 wrote to memory of 1056	1468	62,500-payment............exe	WerFault.exe
PID 1468 wrote to memory of 1056	1468	62,500-payment............exe	WerFault.exe
PID 1468 wrote to memory of 1056	1468	62,500-payment............exe	WerFault.exe
PID 1468 wrote to memory of 1056	1468	62,500-payment............exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\62,500-payment............exe
"C:\Users\Admin\AppData\Local\Temp\62,500-payment............exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\62,500-payment............exe
"C:\Users\Admin\AppData\Local\Temp\62,500-payment............exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 148
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1056

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi276F.tmp\bxahduya.dll
MD5
aaa1bfbfdabb8d567faa91ce5794ab25

SHA1
a4a40b93c008f0780a7ded5e512f56f64e8c31de

SHA256
0960a9ca71aba14f0d6c6a47957a22d966cd0f53cc1df846eabaaf6b72979fbb

SHA512
8c0d93d7d5107d3cf713721ba6c221da67f4ec6bc13b6315854e277f6007cad910bc45f3c5541dbb34dc1d6685dce3d65a84d71d32702d75646dc51f7710cce2

Download Submit
memory/1056-67-0x0000000000000000-mapping.dmp

Download
memory/1056-69-0x00000000004B0000-0x00000000004DE000-memory.dmp

Filesize
184KB

Download
memory/1468-57-0x0000000000000000-mapping.dmp

Download
memory/1468-58-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1468-62-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1584-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing