Analysis
- max time kernel
56s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
08/09/2022, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
2910537.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2910537.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2910537.exe
- Size 16KB
- Sample220908-qkt1faefd9
- SHA256 26ab2e1e2da5ccbac9b660120cc9533cc25fafdb682e97265d2180394b49b05d
- MD5 ba2138d07b96399a92ca10e68e013df3
- SHA1 cb97ba4a0e70282697a107d6a6238afa87868aae
- SHA512 5f3884ae966a241ffca27ba1ee1ff66902850d0301852d5b38cb64f593c11deec9b7ac284ba3ed5dc169ea88991d62f2dc93f441aa82027553d059224168add3
- SSDEEP 192:rW3fMHORB4LCuN/2d36Jcv+gkanGUUOb7d0KJkMQGEwFkFzFKgVymO+9OPfM5uLS:rWvKxLrod3662gjnB10AQb33ji8Yv/6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 7 IoCs
resource yara_rule behavioral1/memory/536-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-72-0x00000000004080E4-mapping.dmp family_neshta behavioral1/memory/536-75-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-78-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-79-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2910537.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Loads dropped DLL 1 IoCs
pid Process 536 2910537.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hqqxt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ybaczgtda\\Hqqxt.exe\"" 2910537.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1660 set thread context of 536 1660 2910537.exe 31 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2910537.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2910537.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2910537.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2910537.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2910537.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1076 powershell.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1660 2910537.exe Token: SeDebugPrivilege 1076 powershell.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1076 1660 2910537.exe 28 PID 1660 wrote to memory of 1076 1660 2910537.exe 28 PID 1660 wrote to memory of 1076 1660 2910537.exe 28 PID 1660 wrote to memory of 1076 1660 2910537.exe 28 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31 PID 1660 wrote to memory of 536 1660 2910537.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2910537.exe"C:\Users\Admin\AppData\Local\Temp\2910537.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Users\Admin\AppData\Local\Temp\2910537.exeC:\Users\Admin\AppData\Local\Temp\2910537.exe2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:536
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
- Size 252KB
- SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
- MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
- SHA1 ec66cda99f44b62470c6930e5afda061579cde35
- SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
- SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
- MD5 SHA1 SHA512 SSDEEP