Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
08/09/2022, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
2910537.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2910537.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2910537.exe
- Size 16KB
- Sample220908-qkt1faefd9
- SHA256 26ab2e1e2da5ccbac9b660120cc9533cc25fafdb682e97265d2180394b49b05d
- MD5 ba2138d07b96399a92ca10e68e013df3
- SHA1 cb97ba4a0e70282697a107d6a6238afa87868aae
- SHA512 5f3884ae966a241ffca27ba1ee1ff66902850d0301852d5b38cb64f593c11deec9b7ac284ba3ed5dc169ea88991d62f2dc93f441aa82027553d059224168add3
- SSDEEP 192:rW3fMHORB4LCuN/2d36Jcv+gkanGUUOb7d0KJkMQGEwFkFzFKgVymO+9OPfM5uLS:rWvKxLrod3662gjnB10AQb33ji8Yv/6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 6 IoCs
resource yara_rule behavioral2/memory/2004-146-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-147-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2910537.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2910537.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hqqxt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ybaczgtda\\Hqqxt.exe\"" 2910537.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4880 set thread context of 2004 4880 2910537.exe 91 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 2910537.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 2910537.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 2910537.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 2910537.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 2910537.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 2910537.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 2910537.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 2910537.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2910537.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2910537.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2910537.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 2910537.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2910537.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2910537.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3116 powershell.exe 3116 powershell.exe 4880 2910537.exe 4880 2910537.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4880 2910537.exe Token: SeDebugPrivilege 3116 powershell.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4880 wrote to memory of 3116 4880 2910537.exe 84 PID 4880 wrote to memory of 3116 4880 2910537.exe 84 PID 4880 wrote to memory of 3116 4880 2910537.exe 84 PID 4880 wrote to memory of 4076 4880 2910537.exe 90 PID 4880 wrote to memory of 4076 4880 2910537.exe 90 PID 4880 wrote to memory of 4076 4880 2910537.exe 90 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91 PID 4880 wrote to memory of 2004 4880 2910537.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2910537.exe"C:\Users\Admin\AppData\Local\Temp\2910537.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\2910537.exeC:\Users\Admin\AppData\Local\Temp\2910537.exe2⤵PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\2910537.exeC:\Users\Admin\AppData\Local\Temp\2910537.exe2⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2004
-