Overview

overview

10

Static

static

10

6414eee4a1...ad.exe

windows7-x64

10

6414eee4a1...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    158s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 05:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
  • Size 329KB
  • Sample221002-fn4c6shff4
  • SHA256 6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtapersistencespywareupx

Malware Config

Signatures

  • Detect Neshta payload 18 IoCs
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
    "C:\Users\Admin\AppData\Local\Temp\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\3582-490\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\SpyNet\Server.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Windows\SpyNet\Server.exe
          C:\Windows\SpyNet\Server.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            5⤵
              PID:208
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
                PID:3868
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                5⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: SetClipboardViewer
                • Suspicious use of SetWindowsHookEx
                PID:3712
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                5⤵
                  PID:4668

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              GOOGLE~2.EXE
              • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE
              • Size 292KB
              • SHA256 c8c9eebf6dadaa6d433bec14a9b9aa521b3b7ecdd74df542aa2cee9cd5f0725b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GOOGLE~4.EXE
              • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE
              • Size 445KB
              • SHA256 746119286fec5a58b16c606ec17652b3ccac611a898321c379be48e6d3be0252
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MICROS~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE
              • Size 241KB
              • SHA256 5dbab8e68c7a000fce8363b79a49b11e009edb3219b56fa78821f044af598767
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\BHO\ie_to_edge_stub.exe
              • Size 537KB
              • SHA256 49593d97b8367cddb5e341e367c851573c076fa052639e08d933e5203b77b5ef
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\INSTAL~1\setup.exe
              • Size 3.2MB
              • SHA256 f68ee8f47c69284ceabde249d8f9406f35f085353a299a8707a24c6b34b775c6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\cookie_exporter.exe
              • Size 156KB
              • SHA256 6a4a49328946be26ca31632af3e5441ba2b8247a51671de188c86821f1eb890b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\elevation_service.exe
              • Size 1.7MB
              • SHA256 2a228d131fd39876865c31dadd000193978618637ca12408e42f4060aa2f466c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\identity_helper.exe
              • Size 1.1MB
              • SHA256 58b3fc8e0f6d38e27f8f5b7984e70ec6132fddd5e05169d4026c1b3a9e43d5e4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\msedge.exe
              • Size 3.7MB
              • SHA256 948c53598e61e6d12a0dd7d70086e94e26ea4844472586ab6786311ece8329ba
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedge_proxy.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\msedge_proxy.exe
              • Size 1.2MB
              • SHA256 b6fa887a2438cb5bea974731b5abff7b4291171644cd384aad91e8ccc243dca5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedge_pwa_launcher.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\msedge_pwa_launcher.exe
              • Size 1.9MB
              • SHA256 23fae3e0e305b89fd764fe24cc545dfc6f76b3e3ad8a402b51f229308806c0b2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\msedgewebview2.exe
              • Size 3.2MB
              • SHA256 75367284d50434c966d4126241682829523a0baa1c03163b9383433182433a75
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\notification_helper.exe
              • Size 1.3MB
              • SHA256 1bb2b789bf7890e583958a213a20a20c920972ecac9e1874c04b49d28f69f224
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              pwahelper.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\104012~1.47\pwahelper.exe
              • Size 1.1MB
              • SHA256 2bd534244e50c34d36957c30cb26077ef7e91635eb93df15d1b16c867b125c3f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              UNINST~1.EXE
              • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
              • Size 129KB
              • SHA256 c8ef54853df3a3b64aa4b1ecfb91615d616c7ff998589e5a3434118611ad2a24
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
              • Size 288KB
              • SHA256 a4bf4d0b9a05d35ff85579f69ca079f5bcf4a3d91f204aad619d2d156ef87875
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\6414eee4a13366b8e595d24638aed247c5840bb97699eedd5419e354d6e5c0ad.exe
              • Size 288KB
              • SHA256 a4bf4d0b9a05d35ff85579f69ca079f5bcf4a3d91f204aad619d2d156ef87875
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Server.exe
              • Path C:\Windows\SpyNet\Server.exe
              • Size 288KB
              • SHA256 a4bf4d0b9a05d35ff85579f69ca079f5bcf4a3d91f204aad619d2d156ef87875
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Server.exe
              • Path C:\Windows\SpyNet\Server.exe
              • Size 288KB
              • SHA256 a4bf4d0b9a05d35ff85579f69ca079f5bcf4a3d91f204aad619d2d156ef87875
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 064990e1207d79f912b8d644f2628453ef6dadeef75f5675988a797760599d82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 064990e1207d79f912b8d644f2628453ef6dadeef75f5675988a797760599d82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OFFICE~1.EXE
              • Path C:\odt\OFFICE~1.EXE
              • Size 5.1MB
              • SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/1644-144-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/1644-154-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-153-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-151-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-150-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-149-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-148-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/3712-155-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/4808-140-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download

              memory/4808-135-0x0000000000C80000-0x0000000000D70000-memory.dmp
              Download