neshta | cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1

General

Target

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
Size

1.4MB
MD5

f86baa5f7ec577a266f56c03882a3777
SHA1

93b59618c52a95d397e8d0648645be54e2b46f40
SHA256

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1
SHA512

96eeedd87f68f2ff2c645bcf040fa7140db2451ec23a495b69c0a4d84461d65922995c02021a5ea7a3ebad51b5bcf9b0549fc96b7537b8e59aaf59cd5222f10e

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

pid process

1764 cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

pid	process
1764	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Loads dropped DLL 2 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

pid	process
1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Drops file in Windows directory 1 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

description ioc process

File opened for modification C:\Windows\svchost.com cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Modifies registry class 1 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

description	pid	process	target process
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
PID 1448 wrote to memory of 1764	1448	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe	cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe

C:\Users\Admin\AppData\Local\Temp\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
"C:\Users\Admin\AppData\Local\Temp\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\3582-490\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe"
2⤵
- Executes dropped EXE
PID:1764

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
MD5
cfbec8b8a6569ebec1ebf5b2da2bfbf6

SHA1
942b04df240b6208234b8ef60475be41064f954f

SHA256
8cec7e625539c699b416abcea419c57d7072fe43af20aaafb6bdcea9e3700bb2

SHA512
642d358ea416a51b713cfaf9619c382182c089c1eb0de90e8f6813b6c21dea197dc8e4ccda1f8d78c6e56a7b334b7f69bec196844ad045a7d1f7b4f93a2c0e29

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1.exe
MD5
cfbec8b8a6569ebec1ebf5b2da2bfbf6

SHA1
942b04df240b6208234b8ef60475be41064f954f

SHA256
8cec7e625539c699b416abcea419c57d7072fe43af20aaafb6bdcea9e3700bb2

SHA512
642d358ea416a51b713cfaf9619c382182c089c1eb0de90e8f6813b6c21dea197dc8e4ccda1f8d78c6e56a7b334b7f69bec196844ad045a7d1f7b4f93a2c0e29

Download Submit
memory/1448-54-0x0000000076001000-0x0000000076003000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads