neshta | c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d

General

Target

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Size

1.8MB
MD5

9868d32d73f7610b111f6a4660dd6da8
SHA1

29e9c0e8a15c05e5add158dc899b6d890f626cc9
SHA256

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d
SHA512

e01eef8b9ba4252b987c1fce3a57dee7414ea89868f417d21f0624eca8deb43c039ca8f54b7118f8d7c6fe58c4a1f6af480157f2d65b7e6c148fa614056fbd6e

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

pid process

960 c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

pid	process
960	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Loads dropped DLL 2 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

pid	process
1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Drops file in Windows directory 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description ioc process

File opened for modification C:\Windows\svchost.com c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Modifies registry class 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	pid	process	target process
PID 1396 wrote to memory of 960	1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
PID 1396 wrote to memory of 960	1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
PID 1396 wrote to memory of 960	1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
PID 1396 wrote to memory of 960	1396	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

C:\Users\Admin\AppData\Local\Temp\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
"C:\Users\Admin\AppData\Local\Temp\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe"
2⤵
- Executes dropped EXE
PID:960

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Filesize
1.7MB

MD5
4a33855818b62c3b24babbd51b5eb464

SHA1
abc0ea29985e2c4e9525385f751e18d982ede93f

SHA256
bbe6db83c9a6fea772240f1dae92702c197e027a4b7328b9c4e364ed04d6eab8

SHA512
a0103048dfd880af346246c6e5af3392725bda12597e090d101ecb2b50d14dc5726f86bfb59f2873f5e1d2fa6379cd191ed94f1d3f9c4efaab6703327599e10f

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Filesize
1.7MB

MD5
4a33855818b62c3b24babbd51b5eb464

SHA1
abc0ea29985e2c4e9525385f751e18d982ede93f

SHA256
bbe6db83c9a6fea772240f1dae92702c197e027a4b7328b9c4e364ed04d6eab8

SHA512
a0103048dfd880af346246c6e5af3392725bda12597e090d101ecb2b50d14dc5726f86bfb59f2873f5e1d2fa6379cd191ed94f1d3f9c4efaab6703327599e10f

Download Submit
memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/1396-54-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads