neshta | 1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4

General

Target

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
Size

1.5MB
MD5

ccbb3310fa1c3c16526a500a5ee50dee
SHA1

eee28f907444a635f84063c2bc39038c4405cf5e
SHA256

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4
SHA512

fb5099b1ce172cbcec95303f3ca12b16784debae995d429155af638548b7d2cea3ac8959f6bdd989a37c1c0494f99db1b962a973d04accaf7be955b7ac9acf49

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

pid process

3588 1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

pid	process
3588	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Drops file in Windows directory 1 IoCs

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description ioc process

File opened for modification C:\Windows\svchost.com 1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 3588 WerFault.exe 1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

pid	pid_target	process	target process
1988	3588	WerFault.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Modifies registry class 1 IoCs

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

description	pid	process	target process
PID 1932 wrote to memory of 3588	1932	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
PID 1932 wrote to memory of 3588	1932	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
PID 1932 wrote to memory of 3588	1932	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe	1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe

C:\Users\Admin\AppData\Local\Temp\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
"C:\Users\Admin\AppData\Local\Temp\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\3582-490\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe"
2⤵
- Executes dropped EXE
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
3⤵
- Program crash
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3588 -ip 3588
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
Filesize
1.5MB

MD5
b5a7a2de2a14cd02335aab272f2bae20

SHA1
2206c5d9fe05bbd844a8d85cece23156de6d3232

SHA256
22a4705aac9a75b9edd23d13b34de5dce1d33c834956a77ccbc76c678cd9ad7d

SHA512
02bd1cdc0e02cfc6b4f69ce68a5a0750c5ae2cd9dfdedf62c4d9fda862270c943e8afbd60a283933c87400ee29050341164fc4ffba96ff0806c23bda61bcfb31

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\1c4352f1951006a2a462a900532af9d2f2a45deb200c03feae5202c975bc36b4.exe
Filesize
1.5MB

MD5
b5a7a2de2a14cd02335aab272f2bae20

SHA1
2206c5d9fe05bbd844a8d85cece23156de6d3232

SHA256
22a4705aac9a75b9edd23d13b34de5dce1d33c834956a77ccbc76c678cd9ad7d

SHA512
02bd1cdc0e02cfc6b4f69ce68a5a0750c5ae2cd9dfdedf62c4d9fda862270c943e8afbd60a283933c87400ee29050341164fc4ffba96ff0806c23bda61bcfb31

Download Submit
memory/3588-130-0x0000000000000000-mapping.dmp

Download
memory/3588-133-0x0000000000D50000-0x0000000000ED2000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads