Analysis

  • max time kernel
    174s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 17:58

General

  • Target

    a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

  • Size

    970KB

  • MD5

    6e1bf2aa439c7b5aa10e19e4c8157820

  • SHA1

    cbad049711bc1e4abb2f2255d7836ce496664dce

  • SHA256

    a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2

  • SHA512

    22a4abafef557a61d37434d5718acf99ae2cfa40e203ff1917097b1b7b848b28e0ffa1dca8b600a577748cd2622b07248193526a8cefb42d056f3a9248997f76

  • SSDEEP

    12288:6xTsYsTsVbMB+QtIrA0X5pUCXVIBkd0/Qw7:6yHgeB+Q+U0X5pbOBkd0/b

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe
    "C:\Users\Admin\AppData\Local\Temp\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 536
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:1432

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

          Filesize

          252KB

          MD5

          9e2b9928c89a9d0da1d3e8f4bd96afa7

          SHA1

          ec66cda99f44b62470c6930e5afda061579cde35

          SHA256

          8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

          SHA512

          2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • \Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

          Filesize

          930KB

          MD5

          273371bb81fe2b644a5b501a20c7a485

          SHA1

          a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

          SHA256

          4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

          SHA512

          6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

        • memory/1780-60-0x0000000000D80000-0x0000000000E64000-memory.dmp

          Filesize

          912KB

        • memory/1908-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

          Filesize

          8KB