Analysis

  • max time kernel
    129s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2022, 21:17

General

  • Target

    430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

  • Size

    249KB

  • MD5

    06c79fea6d2c07fb8fc644b0c44ae877

  • SHA1

    9f86ef9342cb866ca65586704f90e3f536885f71

  • SHA256

    430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae

  • SHA512

    f027d9c1b1d08b5f80332ba61f1597702f521dcfcff7af9f6d1404ba72adce6f450d39be8edaa1bd677724a63f378c97d92bcb85f978fc34c505b34516e34e9f

  • SSDEEP

    6144:k94iTpiE+frpjF+q+o1f31qR6e34qFj0zM:HcpiE+frpjV+o1N6VFj1

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe
    "C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      PID:1436

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

          Filesize

          208KB

          MD5

          9b1538fb702ecbf1d33ecea246cade4d

          SHA1

          6a36d90290f7959eb8da0b787ccfb5b29f140893

          SHA256

          cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40

          SHA512

          0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

        • C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

          Filesize

          208KB

          MD5

          9b1538fb702ecbf1d33ecea246cade4d

          SHA1

          6a36d90290f7959eb8da0b787ccfb5b29f140893

          SHA256

          cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40

          SHA512

          0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

        • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

          Filesize

          252KB

          MD5

          9e2b9928c89a9d0da1d3e8f4bd96afa7

          SHA1

          ec66cda99f44b62470c6930e5afda061579cde35

          SHA256

          8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

          SHA512

          2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

        • \Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

          Filesize

          208KB

          MD5

          9b1538fb702ecbf1d33ecea246cade4d

          SHA1

          6a36d90290f7959eb8da0b787ccfb5b29f140893

          SHA256

          cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40

          SHA512

          0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

        • \Users\Admin\AppData\Local\Temp\nstD73E.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • \Users\Admin\AppData\Local\Temp\nstD73E.tmp\nsisos.dll

          Filesize

          5KB

          MD5

          69806691d649ef1c8703fd9e29231d44

          SHA1

          e2193fcf5b4863605eec2a5eb17bf84c7ac00166

          SHA256

          ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

          SHA512

          5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

        • memory/1748-54-0x0000000076091000-0x0000000076093000-memory.dmp

          Filesize

          8KB