neshta | 90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8

General

Target

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
Size

548KB
MD5

ad2365feea83d9c1aa8cf3985862fa36
SHA1

fcb80cedf8b24111c5b5d2650c9b242d3205c871
SHA256

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8
SHA512

b931f568b4f0280ed7e968b02382cc2708a30faa4954a9ae6c4e0a8c567787290bf1ec3707e471c49813652a0db5542ce014a4e4d2d2e15393276613e6ed946b

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

pid process

1836 90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

pid	process
1836	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Loads dropped DLL 2 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

pid	process
748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Drops file in Windows directory 1 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

description ioc process

File opened for modification C:\Windows\svchost.com 90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Modifies registry class 1 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

description	pid	process	target process
PID 748 wrote to memory of 1836	748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
PID 748 wrote to memory of 1836	748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
PID 748 wrote to memory of 1836	748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
PID 748 wrote to memory of 1836	748	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe	90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe

C:\Users\Admin\AppData\Local\Temp\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
"C:\Users\Admin\AppData\Local\Temp\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\3582-490\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe"
2⤵
- Executes dropped EXE
PID:1836

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
Filesize
507KB

MD5
932edd3df442ad62af3ca8c8ed0b44d9

SHA1
b1fee0fd1daaa6c00873b02a9b048f2b31ac8011

SHA256
33043d752e3f68aef12dfab8ae7770132be91b8c2a86335cff5ba05670225e06

SHA512
d14dd25afe40be0416e244c6c25f050f5a7f1defd645b6623369ca40a4bd904aea819f328be1bcdb3d2d943cc7fdcfee64c9e24ce53ab0c4633ba787ab0ad5ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
Filesize
507KB

MD5
932edd3df442ad62af3ca8c8ed0b44d9

SHA1
b1fee0fd1daaa6c00873b02a9b048f2b31ac8011

SHA256
33043d752e3f68aef12dfab8ae7770132be91b8c2a86335cff5ba05670225e06

SHA512
d14dd25afe40be0416e244c6c25f050f5a7f1defd645b6623369ca40a4bd904aea819f328be1bcdb3d2d943cc7fdcfee64c9e24ce53ab0c4633ba787ab0ad5ca

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\90d2dc8efcb366052f00fae3e76d5188402a77a91b720958b9c74c15b9fb33d8.exe
Filesize
507KB

MD5
932edd3df442ad62af3ca8c8ed0b44d9

SHA1
b1fee0fd1daaa6c00873b02a9b048f2b31ac8011

SHA256
33043d752e3f68aef12dfab8ae7770132be91b8c2a86335cff5ba05670225e06

SHA512
d14dd25afe40be0416e244c6c25f050f5a7f1defd645b6623369ca40a4bd904aea819f328be1bcdb3d2d943cc7fdcfee64c9e24ce53ab0c4633ba787ab0ad5ca

Download Submit
memory/748-54-0x0000000076811000-0x0000000076813000-memory.dmp

Filesize
8KB

Download
memory/1836-56-0x0000000000000000-mapping.dmp

Download
memory/1836-59-0x00000000002A0000-0x0000000000326000-memory.dmp

Filesize
536KB

Download
memory/1836-60-0x00000000048C0000-0x0000000004964000-memory.dmp

Filesize
656KB

Download
memory/1836-63-0x0000000004975000-0x0000000004986000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads