neshta | 4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80

General

Target

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
Size

40KB
MD5

54ce9ef4355a789e4b8b9551c5d961b0
SHA1

cd1544b0d9396b49a1e27e17dfc6fac24221456d
SHA256

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80
SHA512

2d4b906741682a71f8d19290fecb1ae9dae697390b6e21b6adfec537d6e4b06bf3ac88d60f65efb3c382db074e14bf5731d9c533f3b185d264d41242946fff68
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\ELEVAT~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\INSTAL~1\setup.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~3.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\msedge.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\NOTIFI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\BHO\IE_TO_~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\PWAHEL~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

Drops file in Windows directory 1 IoCs

Processes:

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

description ioc process

File opened for modification C:\Windows\svchost.com 4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

Modifies registry class 1 IoCs

Processes:

4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe

C:\Users\Admin\AppData\Local\Temp\4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe
"C:\Users\Admin\AppData\Local\Temp\4d5200e694b15456018b87a8235fd0de2dfdac4977fee431e0923ef997027d80.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4952