neshta | 528a540044eb5dfab9ecbd301a63c69c930eea01e090eddd57a38e2cccb325ac

General

Target

790d2773e6a7ab6c925661e008dc57d5.exe
Size

556KB
MD5

790d2773e6a7ab6c925661e008dc57d5
SHA1

96056d53acef34d5f75d93c86fe38a4027923443
SHA256

528a540044eb5dfab9ecbd301a63c69c930eea01e090eddd57a38e2cccb325ac
SHA512

4ca8fbbd20674a7cd8d6a8cd54ddbff8510c5802030f1c9086f8bd939523e8b6a0bdc148711184c28c60771de059e51bef22a6167963577f0d060e397580e46b

Score

10^/10

neshta xloader ea0r loader persistence rat spyware stealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	790d2773e6a7ab6c925661e008dc57d5.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1412-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1412-120-0x000000000041D410-mapping.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe790d2773e6a7ab6c925661e008dc57d5.exe

pid process

1240 790d2773e6a7ab6c925661e008dc57d5.exe
1412 790d2773e6a7ab6c925661e008dc57d5.exe
Loads dropped DLL 1 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

pid process

1240 790d2773e6a7ab6c925661e008dc57d5.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

description pid process target process

PID 1240 set thread context of 1412 1240 790d2773e6a7ab6c925661e008dc57d5.exe 790d2773e6a7ab6c925661e008dc57d5.exe

pid	process
1240	790d2773e6a7ab6c925661e008dc57d5.exe
1412	790d2773e6a7ab6c925661e008dc57d5.exe

pid	process
1240	790d2773e6a7ab6c925661e008dc57d5.exe

description	pid	process	target process
PID 1240 set thread context of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe

Drops file in Program Files directory 53 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	790d2773e6a7ab6c925661e008dc57d5.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	790d2773e6a7ab6c925661e008dc57d5.exe

Drops file in Windows directory 1 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

description ioc process

File opened for modification C:\Windows\svchost.com 790d2773e6a7ab6c925661e008dc57d5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	790d2773e6a7ab6c925661e008dc57d5.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe	nsis_installer_2

Modifies registry class 1 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	790d2773e6a7ab6c925661e008dc57d5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe

pid process

1412 790d2773e6a7ab6c925661e008dc57d5.exe
1412 790d2773e6a7ab6c925661e008dc57d5.exe

pid	process
1412	790d2773e6a7ab6c925661e008dc57d5.exe
1412	790d2773e6a7ab6c925661e008dc57d5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

790d2773e6a7ab6c925661e008dc57d5.exe790d2773e6a7ab6c925661e008dc57d5.exe

description	pid	process	target process
PID 2512 wrote to memory of 1240	2512	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 2512 wrote to memory of 1240	2512	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 2512 wrote to memory of 1240	2512	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe
PID 1240 wrote to memory of 1412	1240	790d2773e6a7ab6c925661e008dc57d5.exe	790d2773e6a7ab6c925661e008dc57d5.exe

C:\Users\Admin\AppData\Local\Temp\790d2773e6a7ab6c925661e008dc57d5.exe
"C:\Users\Admin\AppData\Local\Temp\790d2773e6a7ab6c925661e008dc57d5.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe
MD5
a8538dba14e963ac7894257f7466bc06

SHA1
d5de28b9a2f41519f8ae6fc2be6f9ee75569e192

SHA256
7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f

SHA512
04da55fb7dcd87538e284a929b79427bf72241fea7a291f3650853442f889cf21de0352f7a381bae316df852f3b0ea87e5eb9ce8e3e509a27ab34da0b78030ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe
MD5
a8538dba14e963ac7894257f7466bc06

SHA1
d5de28b9a2f41519f8ae6fc2be6f9ee75569e192

SHA256
7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f

SHA512
04da55fb7dcd87538e284a929b79427bf72241fea7a291f3650853442f889cf21de0352f7a381bae316df852f3b0ea87e5eb9ce8e3e509a27ab34da0b78030ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\790d2773e6a7ab6c925661e008dc57d5.exe
MD5
a8538dba14e963ac7894257f7466bc06

SHA1
d5de28b9a2f41519f8ae6fc2be6f9ee75569e192

SHA256
7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f

SHA512
04da55fb7dcd87538e284a929b79427bf72241fea7a291f3650853442f889cf21de0352f7a381bae316df852f3b0ea87e5eb9ce8e3e509a27ab34da0b78030ba

Download Submit
\Users\Admin\AppData\Local\Temp\nsk1C10.tmp\sodxedmub.dll
MD5
0dce769f700f91a640a0ac88b9f52cc0

SHA1
593939ad9b4c96d84fb8649bd81a670e8036db19

SHA256
8ea5809102a56af3cbe2dead5d07c4a740afac59ae44f908dd73dbd2314a6018

SHA512
b1546a0ec312e6f4cf50b01c15fd37d911a39eea6e465be113c9e38f87af4f5cde649bdf8939496a7aaceec05988de1bc9249fce8ddc0fce3d1c2f94ead33a52

Download Submit
memory/1240-115-0x0000000000000000-mapping.dmp

Download
memory/1412-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1412-120-0x000000000041D410-mapping.dmp

Download
memory/1412-122-0x0000000000A10000-0x0000000000D30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads