Analysis

  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2022, 21:17

General

  • Target

    3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe

  • Size

    292KB

  • MD5

    67ee37407061a487a78b3e65b17ce041

  • SHA1

    6c57ade1be5b951792fb08f15bc5b377a2bde90e

  • SHA256

    3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41

  • SHA512

    537eeee844dcfe8526ac4657f731309bbce5227debc85e32e04cea1d353ce2f08eb132f7115ec41fec72fe8cb406c33371eefe7c62c466eff72c85d4e70f0045

  • SSDEEP

    3072:zr8WDrCoTRXCqU07belg6s9DQ2kR3FEbbXEA253N2AW9RTnvOzGngUzYA:PugRXCqZHelgF9DFS3FOb25WqzGnP

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe
    "C:\Users\Admin\AppData\Local\Temp\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Users\Admin\AppData\Local\Temp\3582-490\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe"
      2⤵
      • Executes dropped EXE
      PID:3996

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3582-490\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe

          Filesize

          252KB

          MD5

          f7375a853fdeb44d9a6ac79ae0b796d3

          SHA1

          686e44610d6d51a27a56d41aad656f9554f67625

          SHA256

          968e00d2b8430cab93fa4b8ebd047ecf9e41ee3d4064df0bc2c59b044861f06a

          SHA512

          3283fc7615f05dbf952ea2e0ca49c06493e8bfabbc6300933b234f1fe2d0cc5d43da963db8a4f3c22f52b89a2714b2a8b53db1c80cd9a1851e8fc42c2b3d39e5

        • C:\Users\Admin\AppData\Local\Temp\3582-490\3a6931547a13869a5cc4fdf7294a216b5e7da10f052c30057621f3a7728fbb41.exe

          Filesize

          252KB

          MD5

          f7375a853fdeb44d9a6ac79ae0b796d3

          SHA1

          686e44610d6d51a27a56d41aad656f9554f67625

          SHA256

          968e00d2b8430cab93fa4b8ebd047ecf9e41ee3d4064df0bc2c59b044861f06a

          SHA512

          3283fc7615f05dbf952ea2e0ca49c06493e8bfabbc6300933b234f1fe2d0cc5d43da963db8a4f3c22f52b89a2714b2a8b53db1c80cd9a1851e8fc42c2b3d39e5