neshta | 19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64

General

Target

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
Size

923KB
MD5

4d42a69f6e64c6cddf46dae65cf831b3
SHA1

8bb21d34d384459fdc05f571fc96849bc47a10c0
SHA256

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64
SHA512

f8f481f8ffdcf36880ea10425db4bb62f46b794fc374fea3773d210bcc301bbda1ea4a11e123cc996f2e7b40950f2276e8c518b0d0882841c90f9932cc0cfc3a

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

pid process

784 19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Loads dropped DLL 2 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

pid	process
1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Drops file in Program Files directory 21 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Drops file in Windows directory 1 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description ioc process

File opened for modification C:\Windows\svchost.com 19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Modifies registry class 1 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

pid	process
784	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
784	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

description	pid	process	target process
PID 1892 wrote to memory of 784	1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
PID 1892 wrote to memory of 784	1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
PID 1892 wrote to memory of 784	1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
PID 1892 wrote to memory of 784	1892	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe	19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

C:\Users\Admin\AppData\Local\Temp\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
"C:\Users\Admin\AppData\Local\Temp\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\3582-490\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
Filesize
326KB

MD5
2387bb2c217cb3a6d88bd4a53c1a3a6e

SHA1
86791b8941ba411ae1ed5121fa4a616bcee4c25f

SHA256
28b4b1b15819ddb40a2a776a96195c5afce5b36b248d45f8375bfebb582fca1f

SHA512
efde6910026f547c91fa9679cf7a4963fc067ede851381192c78381e06742ac8c7af05b4a2d9d051a9610544e70fa0c4000035807e72e658585ba44eb2c1fc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\19d48d20b913323e176a92e29067d817742c7fe928db704079bbd472af04dd64.exe
Filesize
381KB

MD5
e4312ddd2286d3083d52d8acd769c371

SHA1
7ee36041f332ccfeabcf7508525ae69e3d278f0f

SHA256
ee330067c857d9cd74685812dc16ff3c51a151ca9ac7f8cf9e2b70a5bbffed8b

SHA512
8948f7ece51001ebc44634d08ede3ec35246f4ef6fd7dda9f078f08517be023391a7e0b5134e4150f4a77a1e050ba1bc202f0b546c17c448c8b03985120c9c55

Download Submit
memory/784-56-0x0000000000000000-mapping.dmp

Download
memory/1892-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads