Analysis

  • max time kernel
    131s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 13:40

General

  • Target

    b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe

  • Size

    696KB

  • MD5

    eea0bfc956030c707404fe5b4bc3e2bb

  • SHA1

    b4d48794d49a8624f580a1ba8a89dee415d2157f

  • SHA256

    b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057

  • SHA512

    4b6d9a79c8605b89c4073bd00c2ec7f46b63caf29c77c01a2f67f9847528e4d4af1163cddf356f74a2bf7f813cf990b745f4be4f5e7e0948e5e95b5e71a21b55

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe
    "C:\Users\Admin\AppData\Local\Temp\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe"
      2⤵
      • Executes dropped EXE
      PID:2108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe

    Filesize

    656KB

    MD5

    c2bf765cb6d97176eb9708d8153b2057

    SHA1

    773706030e3133ca84c81b578f9d1b0eae138bb5

    SHA256

    75eb6d27b3977d3149f1e61635552dd41145c67a0b38e491ffe66f757e6cf5af

    SHA512

    2b1cf35e76addd894e73a1dff26f3d9b2c6f53cd1b3489d4007467b431800af1b52fb4d29e545fff7fef54e12f411823d1fa55cb701c31f829fe389c93521214

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057.exe

    Filesize

    656KB

    MD5

    c2bf765cb6d97176eb9708d8153b2057

    SHA1

    773706030e3133ca84c81b578f9d1b0eae138bb5

    SHA256

    75eb6d27b3977d3149f1e61635552dd41145c67a0b38e491ffe66f757e6cf5af

    SHA512

    2b1cf35e76addd894e73a1dff26f3d9b2c6f53cd1b3489d4007467b431800af1b52fb4d29e545fff7fef54e12f411823d1fa55cb701c31f829fe389c93521214

  • memory/2108-130-0x0000000000000000-mapping.dmp