Overview

overview

10

Static

static

10

4438324300...00.exe

windows7-x64

10

4438324300...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
  • Size 194KB
  • Sample221011-2rfbeahhc5
  • SHA256 44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtapersistencespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 29 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 20 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
    "C:\Users\Admin\AppData\Local\Temp\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\3582-490\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\rundll32.exe" advpack.dll,LaunchINFSection Mycursor.inf, DefaultInstall,3
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\System32\rundll32.exe advpack.dll,LaunchINFSection Mycursor.inf, DefaultInstall,3
          4⤵
          • Drops file in Windows directory
          • Modifies Control Panel
          PID:4044

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jusched.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
        • Size 664KB
        • SHA256 5cbea72c5565c342e07edfc8902eeea7cfb450362f2ce0cb7b1b184dbf72ef64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GO664E~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
        • Size 178KB
        • SHA256 98764ffe0366a01ae235033054556e52d6061633dfb6fba210940c89500809d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOF5E2~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
        • Size 138KB
        • SHA256 c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOOGLE~3.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
        • Size 366KB
        • SHA256 c8f05c107ecdc905dd2b3c708c40eb50118a65d497e12df6958ce5e1a53af108
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MI391D~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MI391D~1.EXE
        • Size 138KB
        • SHA256 5ebc3f39f74c75222636cd5a39f2d6c171c16e43a104d98d6d524b670d68b63f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~1.EXE
        • Size 241KB
        • SHA256 51b57bcb841e6c41f2e6ad229809f7b8f5fa5c3130df0ec890b8ceacd69ea9cb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe
        • Size 250KB
        • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IE_TO_~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE
        • Size 509KB
        • SHA256 da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTIFI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE
        • Size 1.3MB
        • SHA256 75530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE
        • Size 1.1MB
        • SHA256 29a9658e5031d3d6e199e66c8cdddd436d6de0e034cfd8b02d5a889bac256c99
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
        • Size 494KB
        • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
        • Size 526KB
        • SHA256 f71d62354d4c6eec8a9cd14db442b9a5f2a6550468b01bda06f82acaa8e0c9b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
        • Size 495KB
        • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
        • Size 494KB
        • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        INTEGR~1.EXE
        • Path C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
        • Size 6.7MB
        • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
        • Size 526KB
        • SHA256 f71d62354d4c6eec8a9cd14db442b9a5f2a6550468b01bda06f82acaa8e0c9b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
        • Size 714KB
        • SHA256 cfe1e68b3ba71c7f4c7c6f2065fc670b6df0293281227f271ec78becf7405c44
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
        • Size 525KB
        • SHA256 e81e4630b01d181fb3116e9e874eedfe1a43472bfa6d83cc24f55e78721ddf86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
        • Size 495KB
        • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OneDrive.exe
        • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
        • Size 1.7MB
        • SHA256 91630469f3d18ebf1be43522b6dcb6547c3b67ab7a17a246e1b2122628dfcd80
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
        • Size 153KB
        • SHA256 1277746f4a302f644ac2910b7e80b51a9cf7c55be8f88fc8cdfae7b01dbf58be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00.exe
        • Size 153KB
        • SHA256 1277746f4a302f644ac2910b7e80b51a9cf7c55be8f88fc8cdfae7b01dbf58be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_A~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_A~1.CUR
        • Size 4KB
        • SHA256 bd5863c01bdad1b10b08726e1932dac53aedfa0737be305c63df536afd9b3b74
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_B~1.ANI
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_B~1.ANI
        • Size 75KB
        • SHA256 a8ab3345ac31bb07edfc972933e244edd73b9416e4cb9bbe975472e3a50b12a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_H~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_H~1.CUR
        • Size 4KB
        • SHA256 559eeaad1f057226d2965c507094a72584a3f23d2a987635cf0f53b7ea79b33b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_L~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_L~1.CUR
        • Size 4KB
        • SHA256 98fdf59ac899a9c2510b5064b50be5b61b48ccfd0b9247874a6097793f2c3057
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_M~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_M~1.CUR
        • Size 4KB
        • SHA256 54181c6b555396ba623781663dc20388edf85cfc49a7d86466dbb937dcead4b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_N~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_N~1.CUR
        • Size 4KB
        • SHA256 de8ca70a6bd0e8738200cfe5a9d2e50514c8274e39e9939493726cc307ea7df4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_N~2.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_N~2.CUR
        • Size 4KB
        • SHA256 26ba676103297f4fe9dba4d49238be80b1a7dbb1e869ec1a0986c6e7afdfd07b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_P~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_P~1.CUR
        • Size 4KB
        • SHA256 82960bbb060bf78779c736e325c83a30fb44f8f5d4d05ba984f7594e2f7438b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_S~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_S~1.CUR
        • Size 4KB
        • SHA256 df2de2269ac181eca37be88f50613d4e64fe1bb32e597b442f681e470db33b14
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_U~1.CUR
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_U~1.CUR
        • Size 4KB
        • SHA256 d765ab5b0ee32b0a8cb3b3b133766101bf95741afb6a45621acae0b8ca662bfc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AERO_W~1.ANI
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_W~1.ANI
        • Size 75KB
        • SHA256 8685bf675bed7c0626fed013acf52ab81b9a3ba09e6830a5733d43a50d43a73c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Mycursor.inf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mycursor.inf
        • Size 2KB
        • SHA256 d9de7ae638b0347d48055dbf60142fe65978cc5cb2b8d7f54a61916c1cc103d4
        • MD5 SHA1 SHA512
        Submit Download

        aero_alt.cur
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\aero_alt.cur
        • Size 4KB
        • SHA256 e12b2bb99ec88e854843af4ad59aa2b7848fac401102a692896d5cb9ee7b3969
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aero_ew.cur
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\aero_ew.cur
        • Size 4KB
        • SHA256 093c36f1baa94b49498b173a197a99c72835381aa0b1823ae669eb19adfcc430
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aero_ns.cur
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\aero_ns.cur
        • Size 4KB
        • SHA256 ae87e1be2012a8d22db328bec839cc01705776df4a8668a373d2d7efd918cc09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aero_pen.cur
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\aero_pen.cur
        • Size 4KB
        • SHA256 7e99a350ddaf9d1bf939f26a0a365e6677b0770ef70332fc478729473598c46a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp5023.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
        • Size 8B
        • SHA256 00712ac8ac033e45c2ebd4846b393561d97888524272a0c6e5bbc20e7f874133
        • MD5 SHA1 SHA512
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 ff4f1b62afdb5f2ff2ca6b473367772d5adbe16986bc5e5b20fea836e9cbd1f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 ff4f1b62afdb5f2ff2ca6b473367772d5adbe16986bc5e5b20fea836e9cbd1f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OFFICE~1.EXE
        • Path C:\odt\OFFICE~1.EXE
        • Size 5.1MB
        • SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download