neshta | c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d

General

Target

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Size

1.8MB
MD5

9868d32d73f7610b111f6a4660dd6da8
SHA1

29e9c0e8a15c05e5add158dc899b6d890f626cc9
SHA256

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d
SHA512

e01eef8b9ba4252b987c1fce3a57dee7414ea89868f417d21f0624eca8deb43c039ca8f54b7118f8d7c6fe58c4a1f6af480157f2d65b7e6c148fa614056fbd6e

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

pid process

4408 c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

pid	process
4408	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~4.EXE	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Drops file in Windows directory 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description ioc process

File opened for modification C:\Windows\svchost.com c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Modifies registry class 1 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

description	pid	process	target process
PID 4548 wrote to memory of 4408	4548	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
PID 4548 wrote to memory of 4408	4548	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
PID 4548 wrote to memory of 4408	4548	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe	c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe

C:\Users\Admin\AppData\Local\Temp\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
"C:\Users\Admin\AppData\Local\Temp\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548

C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe"
2⤵
- Executes dropped EXE
PID:4408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Filesize
1.7MB

MD5
4a33855818b62c3b24babbd51b5eb464

SHA1
abc0ea29985e2c4e9525385f751e18d982ede93f

SHA256
bbe6db83c9a6fea772240f1dae92702c197e027a4b7328b9c4e364ed04d6eab8

SHA512
a0103048dfd880af346246c6e5af3392725bda12597e090d101ecb2b50d14dc5726f86bfb59f2873f5e1d2fa6379cd191ed94f1d3f9c4efaab6703327599e10f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c30493da5b519aec8856ac11a15f898f290ddf9d1cc2e69fdca36ea9abf0e32d.exe
Filesize
1.7MB

MD5
4a33855818b62c3b24babbd51b5eb464

SHA1
abc0ea29985e2c4e9525385f751e18d982ede93f

SHA256
bbe6db83c9a6fea772240f1dae92702c197e027a4b7328b9c4e364ed04d6eab8

SHA512
a0103048dfd880af346246c6e5af3392725bda12597e090d101ecb2b50d14dc5726f86bfb59f2873f5e1d2fa6379cd191ed94f1d3f9c4efaab6703327599e10f

Download Submit
memory/4408-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads