General
-
Target
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad
-
Size
329KB
-
Sample
221002-fn4c6shff4
-
MD5
71a38ef9f04b960290a1433cfc03d530
-
SHA1
3ebffb93d6079e9af04e24e4cf982399c525cd35
-
SHA256
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad
-
SHA512
53086f9190dcefdff0e1a9da121c70562b24658316a56fbca077976fbc86b21f9dd94a7a346bb59394c9772ce04b97caf3a30382fdaf4e0653d1ab7b95946bde
-
SSDEEP
6144:k9RExh5516v+2UUA/HH6s7ejUxVPw/8kfvpIW069OvCETCoC:O0Ll2UUmLlxtw/82IaM1eoC
Behavioral task
behavioral1
Sample
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad
-
Size
329KB
-
MD5
71a38ef9f04b960290a1433cfc03d530
-
SHA1
3ebffb93d6079e9af04e24e4cf982399c525cd35
-
SHA256
6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad
-
SHA512
53086f9190dcefdff0e1a9da121c70562b24658316a56fbca077976fbc86b21f9dd94a7a346bb59394c9772ce04b97caf3a30382fdaf4e0653d1ab7b95946bde
-
SSDEEP
6144:k9RExh5516v+2UUA/HH6s7ejUxVPw/8kfvpIW069OvCETCoC:O0Ll2UUmLlxtw/82IaM1eoC
Score10/10-
Detect Neshta payload
-
Modifies WinLogon for persistence
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-