Overview

overview

10

Static

static

10

5ea6e05b13...32.exe

windows7_x64

10

5ea6e05b13...32.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    7s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 21:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe

  • Size

    968KB

  • MD5

    9eef5461fff193f73726f129d31b9174

  • SHA1

    f98f61077e3185fb31ddb2135288cbe4fb66c599

  • SHA256

    5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732

  • SHA512

    1e4d79da56a4cb9c4cd42556d9a73c0986f3bd269d8362ee661f454c30a6ab65090e469825705a461121a3fe28d0839e55e8c014b96509911b15c57196564d2c

Score
10/10
neshtapersistencespyware

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe
    "C:\Users\Admin\AppData\Local\Temp\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\3582-490\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe"
      2⤵
      • Executes dropped EXE
      PID:4688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe
    Filesize

    928KB

    MD5

    2705a27f42599c04c6f7ebf1e3862fd3

    SHA1

    11035fc37bec733cf2926240ac1d4b19fd2c01f6

    SHA256

    578251af97fedee79e2d562e7d107bf3e787a66f851e6d77780a8c9bb4d86256

    SHA512

    9d3eda4f11095a2bbd3a4f9c63c9d4aba15e7e59580e925b918013351c30d18af89c1a9e1a1e2dec05babf91575bac4e271a7491ed5954408ac39da5380b5709

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\5ea6e05b132d0d86ee45087b2a9147c7e5a87a92e519db9dfb91c5d337917732.exe
    Filesize

    928KB

    MD5

    2705a27f42599c04c6f7ebf1e3862fd3

    SHA1

    11035fc37bec733cf2926240ac1d4b19fd2c01f6

    SHA256

    578251af97fedee79e2d562e7d107bf3e787a66f851e6d77780a8c9bb4d86256

    SHA512

    9d3eda4f11095a2bbd3a4f9c63c9d4aba15e7e59580e925b918013351c30d18af89c1a9e1a1e2dec05babf91575bac4e271a7491ed5954408ac39da5380b5709

    Download Submit
  • memory/4688-130-0x0000000000000000-mapping.dmp
    Download