neshta | bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb | Triage

Analysis

max time kernel
64s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 07:02

Sharing

Report Analysis Logs

General

Target

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
Size

744KB
MD5

a3fc29c6698ca5989e265daec8747bcb
SHA1

dfa0fa264b796d564406f21af73cb77e2f5fe22d
SHA256

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb
SHA512

3e0e79fa91b7a3b8fffd59763ce39203c8e88bceed64cb4964592738546fc2050210cf76df591cfe4badbf76bba9c781518102cc53836e6df09a77497d7e246e

Score

10^/10

neshta pony persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://kahramanlarotolastik.com/w/terry/panel/gate.php

Attributes

payload_url
http://myp0nysite.ru/shit.exe

Signatures

Detect Neshta Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-63-0x0000000000400000-0x00000000004BC000-memory.dmp	family_neshta
behavioral1/memory/2040-64-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

Modify Registry

Change Default File Association

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description	pid	process	target process
PID 1540 set thread context of 2040	1540	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

Drops file in Program Files directory 64 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

Drops file in Windows directory 1 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description ioc process

File opened for modification C:\Windows\svchost.com bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

pid process

1540 bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

description	pid	process	target process
PID 1540 wrote to memory of 2040	1540	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
PID 1540 wrote to memory of 2040	1540	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
PID 1540 wrote to memory of 2040	1540	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
PID 1540 wrote to memory of 2040	1540	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe	bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe

C:\Users\Admin\AppData\Local\Temp\bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
"C:\Users\Admin\AppData\Local\Temp\bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe
  "C:\Users\Admin\AppData\Local\Temp\bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb.exe"
  2⤵
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-56-0x00000000003C0000-0x00000000003C8000-memory.dmp

Filesize
32KB

Download
memory/1540-57-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1540-59-0x00000000003C0000-0x00000000003C8000-memory.dmp

Filesize
32KB

Download
memory/1540-60-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download
memory/1540-61-0x0000000076F30000-0x00000000770B0000-memory.dmp

Filesize
1.5MB

Download
memory/2040-58-0x00000000004914A5-mapping.dmp

Download
memory/2040-63-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2040-64-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2040-72-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download
memory/2040-73-0x0000000076F30000-0x00000000770B0000-memory.dmp

Filesize
1.5MB

Download
memory/2040-74-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2040-75-0x0000000076F30000-0x00000000770B0000-memory.dmp

Filesize
1.5MB

Download