neshta | 04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e

General

Target

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
Size

716KB
MD5

d48adb9a5db15acd5c4003c9aa78aad2
SHA1

ed6f07d7e618a81d353f8e98f6a1dc16f6e73012
SHA256

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e
SHA512

6d9c7d564dd71a7ea461cd81f0379a639cc8a6aa3b31ec89b950b29967ec4c99eae7efb8748df52b93e112a4f3f9a4e8a04ed141bfd982dfcda2d30f62166cd0

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

pid process

1728 04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

pid	process
1728	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Loads dropped DLL 2 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

pid	process
1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Drops file in Windows directory 1 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

description ioc process

File opened for modification C:\Windows\svchost.com 04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Modifies registry class 1 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

description	pid	process	target process
PID 1532 wrote to memory of 1728	1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
PID 1532 wrote to memory of 1728	1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
PID 1532 wrote to memory of 1728	1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
PID 1532 wrote to memory of 1728	1532	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe	04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe

C:\Users\Admin\AppData\Local\Temp\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
"C:\Users\Admin\AppData\Local\Temp\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\3582-490\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe"
2⤵
- Executes dropped EXE
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
Filesize
676KB

MD5
236fa7a1ac4f3d22c215053ad4c6381b

SHA1
d5730d26e48657667e53f242b679a73529e775d7

SHA256
0d1937a68c3f63418646f6888e93ed408fe2642936e80b542a84ad3a18815219

SHA512
70b4d477754ae383797485b93700db16019ed8d8dfec72d812a1cfd0ebd558d998ec86f5016982db034ad9df394d6a636fb335f3b9ba4859ade6317472c6da6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
Filesize
676KB

MD5
236fa7a1ac4f3d22c215053ad4c6381b

SHA1
d5730d26e48657667e53f242b679a73529e775d7

SHA256
0d1937a68c3f63418646f6888e93ed408fe2642936e80b542a84ad3a18815219

SHA512
70b4d477754ae383797485b93700db16019ed8d8dfec72d812a1cfd0ebd558d998ec86f5016982db034ad9df394d6a636fb335f3b9ba4859ade6317472c6da6f

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\04b2f376d1999573aea115b19e44a3c57e87779bb54b9b8d1c56d35188304e0e.exe
Filesize
676KB

MD5
236fa7a1ac4f3d22c215053ad4c6381b

SHA1
d5730d26e48657667e53f242b679a73529e775d7

SHA256
0d1937a68c3f63418646f6888e93ed408fe2642936e80b542a84ad3a18815219

SHA512
70b4d477754ae383797485b93700db16019ed8d8dfec72d812a1cfd0ebd558d998ec86f5016982db034ad9df394d6a636fb335f3b9ba4859ade6317472c6da6f

Download Submit
memory/1532-54-0x0000000075391000-0x0000000075393000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads