neshta | 1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90

General

Target

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
Size

40KB
MD5

33b964e0ef93c35f70c3535886f9086a
SHA1

b4ff61096a939523791e91e662e21da6fa9119c2
SHA256

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90
SHA512

bee83e1ab27ee2292791f3f24cf4fd3cbe83f97cf329f07d9548c4972b44da7a6774308dd352c9f572dbdb1c627c6a7f40132359eb2ad9d94d8e9ea86631f429
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJfMENK:JxqjQ+P04wsmJC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

Drops file in Windows directory 1 IoCs

Processes:

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

description ioc process

File opened for modification C:\Windows\svchost.com 1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

Modifies registry class 1 IoCs

Processes:

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe

C:\Users\Admin\AppData\Local\Temp\1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe
"C:\Users\Admin\AppData\Local\Temp\1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3216