Analysis

  • max time kernel
    103s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    22-01-2022 00:57

General

  • Target

    b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe

  • Size

    208KB

  • MD5

    efa3b342a50f336062d2bd7f06103965

  • SHA1

    d2cd5c11dfcec8b8d642b53a7fe8203dcae09bd6

  • SHA256

    b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4

  • SHA512

    477fbc42737960b986557901f93054b1bfbc2d049fbd36294d83b880c6d3cc033a3c0fa94953359fedf8e068be14ad6fb1aca76870c6e7c776e056c321c751d7

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe
    "C:\Users\Admin\AppData\Local\Temp\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\comp.exe
        C:\Windows\System32\comp.exe
        3⤵
          PID:808

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Change Default File Association

    1
    T1042

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe
      MD5

      636aec521f09a528dbe60c73aa36730d

      SHA1

      ca7ccaa7e8fdb77c9b8fed8f9c1374cd63939785

      SHA256

      46ef2e945097f082d86e8dafbdf3bba0d363c554d4e17a9cab2f8ef1cffc0147

      SHA512

      d9f874360c9d8a9da1388b063c81b5a28f2e2bb2c1f0d0ba5bfacfb9e328f85e93d570dd9a989b4024d963163991d398d8f22a9f69f7ab98cfbb376c110d9007

    • C:\Users\Admin\AppData\Local\Temp\3582-490\b478f1b81364b8498b6ee8779593f2e2b41fa987261abf359c2e1daefbb7a2b4.exe
      MD5

      636aec521f09a528dbe60c73aa36730d

      SHA1

      ca7ccaa7e8fdb77c9b8fed8f9c1374cd63939785

      SHA256

      46ef2e945097f082d86e8dafbdf3bba0d363c554d4e17a9cab2f8ef1cffc0147

      SHA512

      d9f874360c9d8a9da1388b063c81b5a28f2e2bb2c1f0d0ba5bfacfb9e328f85e93d570dd9a989b4024d963163991d398d8f22a9f69f7ab98cfbb376c110d9007

    • memory/808-120-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/808-121-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/808-122-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/808-126-0x0000000000401000-0x000000000043C000-memory.dmp
      Filesize

      236KB

    • memory/808-127-0x000000000042E000-0x000000000043B000-memory.dmp
      Filesize

      52KB

    • memory/3060-125-0x0000000000400000-0x0000000000456000-memory.dmp
      Filesize

      344KB