neshta | fe7c7abae0e36d9582e6189d6405a221924a3006805c5768f9244cf56fe20e53

General

Target

2d57a1af420a6840d8361b9cd76be267.exe
Size

136KB
MD5

2d57a1af420a6840d8361b9cd76be267
SHA1

5282d8171a4f994ae56f291bc51462a9a2bb5daa
SHA256

fe7c7abae0e36d9582e6189d6405a221924a3006805c5768f9244cf56fe20e53
SHA512

6bc2ccf373779937486a7c66a6d51e67043f9defa8ef28cfb8e8271a105c6a0b40478bc68d13f19e8a19b8c9234954e7bbe93e1f63a0e93fb488f64c7add060d
SSDEEP

1536:9xqjQ+P04wsmJCmzi0Zb78ivombfexv0ujXyyed2n3tmulgS6p8li1qqsCbqDylI:wr85Cmzi0ZbYe1g0ujyzdX8iYEwiYjV

Score

10^/10

neshta redline cheat discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

51.120.250.153:62563

Signatures

Detect Neshta payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4248-132-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/4248-141-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	family_neshta
behavioral2/memory/4248-150-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2d57a1af420a6840d8361b9cd76be267.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe	family_redline
behavioral2/memory/5016-136-0x00000000007E0000-0x00000000007FE000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

pid process

5016 2d57a1af420a6840d8361b9cd76be267.exe

pid	process
5016	2d57a1af420a6840d8361b9cd76be267.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2d57a1af420a6840d8361b9cd76be267.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2d57a1af420a6840d8361b9cd76be267.exe

Drops file in Windows directory 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description ioc process

File opened for modification C:\Windows\svchost.com 2d57a1af420a6840d8361b9cd76be267.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	2d57a1af420a6840d8361b9cd76be267.exe

Modifies registry class 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2d57a1af420a6840d8361b9cd76be267.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

pid process

5016 2d57a1af420a6840d8361b9cd76be267.exe
5016 2d57a1af420a6840d8361b9cd76be267.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description pid process

Token: SeDebugPrivilege 5016 2d57a1af420a6840d8361b9cd76be267.exe

pid	process
5016	2d57a1af420a6840d8361b9cd76be267.exe
5016	2d57a1af420a6840d8361b9cd76be267.exe

description	pid	process
Token: SeDebugPrivilege	5016	2d57a1af420a6840d8361b9cd76be267.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	pid	process	target process
PID 4248 wrote to memory of 5016	4248	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe
PID 4248 wrote to memory of 5016	4248	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe
PID 4248 wrote to memory of 5016	4248	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe

C:\Users\Admin\AppData\Local\Temp\2d57a1af420a6840d8361b9cd76be267.exe
"C:\Users\Admin\AppData\Local\Temp\2d57a1af420a6840d8361b9cd76be267.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Filesize
3.2MB

MD5
ee17d6497e91bac548edc0594daf874c

SHA1
5fc8851b2bcc605ce6c243aaf1dfb60975df58e0

SHA256
2caa0896950cdf289b2301b665fc0258b060269cd1a7bff5a16508dbea9d58fc

SHA512
9c80eac5c34164f6be007b5c629ddb2a0737b92df2aee8477eb3797487baa276275f27eb22ac948412c2c28972f18da5e3e579185a2cbf19f3e4fd7d7c68d312

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe

Filesize
95KB

MD5
228d532a3184e5cdd4f6691d0b4b7d54

SHA1
fe5873bb99e05f3f3d335611fd008e230110b5dc

SHA256
38ceabb776214507969c4381db87f69dee76c0dc457ab4550ca739fd5649415f

SHA512
b56b80f5865a0e716350acee5da3cfae6d368f83d0c2221df0807c70c19b346280723295e1db55f0253d109a5205241a0a0788cdd631d6a0190b5b97b31c3ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe

Filesize
95KB

MD5
228d532a3184e5cdd4f6691d0b4b7d54

SHA1
fe5873bb99e05f3f3d335611fd008e230110b5dc

SHA256
38ceabb776214507969c4381db87f69dee76c0dc457ab4550ca739fd5649415f

SHA512
b56b80f5865a0e716350acee5da3cfae6d368f83d0c2221df0807c70c19b346280723295e1db55f0253d109a5205241a0a0788cdd631d6a0190b5b97b31c3ca9

Download Submit
memory/4248-132-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4248-150-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4248-141-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5016-140-0x0000000005470000-0x000000000557A000-memory.dmp

Filesize
1.0MB

Download
memory/5016-139-0x00000000051F0000-0x000000000522C000-memory.dmp

Filesize
240KB

Download
memory/5016-138-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/5016-137-0x00000000057D0000-0x0000000005DE8000-memory.dmp

Filesize
6.1MB

Download
memory/5016-142-0x0000000006890000-0x0000000006A52000-memory.dmp

Filesize
1.8MB

Download
memory/5016-143-0x0000000006F90000-0x00000000074BC000-memory.dmp

Filesize
5.2MB

Download
memory/5016-144-0x0000000006820000-0x0000000006886000-memory.dmp

Filesize
408KB

Download
memory/5016-145-0x0000000006C10000-0x0000000006C86000-memory.dmp

Filesize
472KB

Download
memory/5016-146-0x0000000006D30000-0x0000000006DC2000-memory.dmp

Filesize
584KB

Download
memory/5016-147-0x0000000007A70000-0x0000000008014000-memory.dmp

Filesize
5.6MB

Download
memory/5016-148-0x0000000006E30000-0x0000000006E4E000-memory.dmp

Filesize
120KB

Download
memory/5016-136-0x00000000007E0000-0x00000000007FE000-memory.dmp

Filesize
120KB

Download
memory/5016-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads