General

  • Target

    6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad

  • Size

    329KB

  • Sample

    221002-fn4c6shff4

  • MD5

    71a38ef9f04b960290a1433cfc03d530

  • SHA1

    3ebffb93d6079e9af04e24e4cf982399c525cd35

  • SHA256

    6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad

  • SHA512

    53086f9190dcefdff0e1a9da121c70562b24658316a56fbca077976fbc86b21f9dd94a7a346bb59394c9772ce04b97caf3a30382fdaf4e0653d1ab7b95946bde

  • SSDEEP

    6144:k9RExh5516v+2UUA/HH6s7ejUxVPw/8kfvpIW069OvCETCoC:O0Ll2UUmLlxtw/82IaM1eoC

Malware Config

Targets

    • Target

      6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad

    • Size

      329KB

    • MD5

      71a38ef9f04b960290a1433cfc03d530

    • SHA1

      3ebffb93d6079e9af04e24e4cf982399c525cd35

    • SHA256

      6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad

    • SHA512

      53086f9190dcefdff0e1a9da121c70562b24658316a56fbca077976fbc86b21f9dd94a7a346bb59394c9772ce04b97caf3a30382fdaf4e0653d1ab7b95946bde

    • SSDEEP

      6144:k9RExh5516v+2UUA/HH6s7ejUxVPw/8kfvpIW069OvCETCoC:O0Ll2UUmLlxtw/82IaM1eoC

    • Detect Neshta payload

    • Modifies WinLogon for persistence

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks