Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-02-2022 04:03

General

  • Target

    b6bec797d64005ed44c1ef3720519ffe1174a89e72a37655943b9491d94305ee.exe

  • Size

    1.3MB

  • MD5

    f3f3f21a24e488b982bd729545ff0a98

  • SHA1

    85bcb4af9c5851e98102b7b342fa7d690836f8c4

  • SHA256

    b6bec797d64005ed44c1ef3720519ffe1174a89e72a37655943b9491d94305ee

  • SHA512

    41fe9b72d7bd4881f07057bf9bb32f14f7df9f346af341bce3b807b55900eb951da493d248d5c937d8d588a779dd10e124a30c5565232cee6559668b7155d27a

Malware Config

Signatures

  • Detect Neshta Payload 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6bec797d64005ed44c1ef3720519ffe1174a89e72a37655943b9491d94305ee.exe
    "C:\Users\Admin\AppData\Local\Temp\b6bec797d64005ed44c1ef3720519ffe1174a89e72a37655943b9491d94305ee.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:2828
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:3412
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 49c70d59ee7dd9df79b7065ce6046ad0 LlwADoCY6kOVc9/o9W3pqw.0.1.0.0.0
    1⤵
    • Modifies data under HKEY_USERS
    PID:1880
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:1452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2828-198-0x00000000047A0000-0x00000000047A1000-memory.dmp
    Filesize

    4KB

  • memory/2828-197-0x0000000000400000-0x00000000005A4000-memory.dmp
    Filesize

    1.6MB

  • memory/2828-199-0x0000000004790000-0x0000000004792000-memory.dmp
    Filesize

    8KB

  • memory/2828-200-0x0000000004780000-0x0000000004781000-memory.dmp
    Filesize

    4KB

  • memory/2828-201-0x00000000047C0000-0x00000000047C1000-memory.dmp
    Filesize

    4KB

  • memory/2828-202-0x00000000047D0000-0x00000000047D1000-memory.dmp
    Filesize

    4KB

  • memory/2828-203-0x00000000047B0000-0x00000000047B1000-memory.dmp
    Filesize

    4KB

  • memory/2828-260-0x00000000047F0000-0x00000000047F1000-memory.dmp
    Filesize

    4KB

  • memory/2828-261-0x00000000047E0000-0x00000000047E1000-memory.dmp
    Filesize

    4KB