Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-08-2022 13:32

General

  • Target

    SOA.exe

  • Size

    1.9MB

  • MD5

    081ccbaad04fe1298a6cd6b04c63fd14

  • SHA1

    87a31f4f90543f69f37fdcf7d0a4d8d5ca99de08

  • SHA256

    888101d59c219dc57cf3bec1dec7f3880bfb2e6d966da604eb2485741d72f889

  • SHA512

    e66b75dd580a3c60b418477e5e960b3893b12882981d4df71515262e0ea5c3062230d9d597c0b866c241a670961d124b5fa5f9052e20514b22642bcb9a7688b3

Malware Config

Signatures

  • Detect Neshta payload 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOA.exe
    "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      PID:1560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\ZIFIEQ~1\Rdxymb.exe

    Filesize

    1.9MB

    MD5

    c6b31221b6b2442be5303e7db0e0dde0

    SHA1

    adbf330dfd49e3709899b3f267b7f24a65768919

    SHA256

    93457c3efeb0f9a45f9aad4f5a71fb493e3bc479e598875d867ff065cdb958ee

    SHA512

    7cd5fad83b6ff60df45a72680329e6dfeed782a170dac6afa9d05d1b2c1a8261b99584512e49759e24e5b0850fab4a8e68e34b348bed9d65b08d779824895c51

  • memory/1560-142-0x0000000000000000-mapping.dmp

  • memory/1560-149-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1560-148-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1560-146-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1560-145-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1560-144-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1560-143-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2100-140-0x000000000DB90000-0x000000000DC22000-memory.dmp

    Filesize

    584KB

  • memory/2100-130-0x0000000000630000-0x000000000081E000-memory.dmp

    Filesize

    1.9MB

  • memory/2100-141-0x000000000E1E0000-0x000000000E784000-memory.dmp

    Filesize

    5.6MB

  • memory/2100-131-0x0000000006220000-0x0000000006242000-memory.dmp

    Filesize

    136KB

  • memory/3000-139-0x0000000006560000-0x000000000657A000-memory.dmp

    Filesize

    104KB

  • memory/3000-138-0x00000000078D0000-0x0000000007F4A000-memory.dmp

    Filesize

    6.5MB

  • memory/3000-137-0x0000000004E30000-0x0000000004E4E000-memory.dmp

    Filesize

    120KB

  • memory/3000-136-0x0000000005A50000-0x0000000005AB6000-memory.dmp

    Filesize

    408KB

  • memory/3000-135-0x0000000005260000-0x00000000052C6000-memory.dmp

    Filesize

    408KB

  • memory/3000-134-0x0000000005330000-0x0000000005958000-memory.dmp

    Filesize

    6.2MB

  • memory/3000-133-0x0000000002750000-0x0000000002786000-memory.dmp

    Filesize

    216KB

  • memory/3000-132-0x0000000000000000-mapping.dmp