neshta | c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5

General

Target

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
Size

401KB
MD5

304670fe2180be81c4c4ba7c45423e0b
SHA1

18e602132ad830ed4f108cdd497860d8d7ef79a0
SHA256

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5
SHA512

71556a18b467e82a02806fda0f966832ac33251e1e22a52de65505721515518a7095da25be267fc5cc194a710892beb8323f57aa08f667c8f978e2842acbeeb8
SSDEEP

6144:k9JYCuQD4bGWx8JlRLoCVv4H79Iu/crfHS2ULQQhzodcXNOoizXZm3:S4QUbGoirEWYKu/crfHS2UHzodoizJK

Score

10^/10

neshta persistence spyware stealer vmprotect

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

pid process

1712 c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

pid	process
1712	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe	vmprotect
behavioral1/memory/1712-57-0x0000000000400000-0x00000000004AD000-memory.dmp	vmprotect

Loads dropped DLL 2 IoCs

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

pid	process
1756	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
1756	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

Drops file in Windows directory 1 IoCs

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

description ioc process

File opened for modification C:\Windows\svchost.com c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

Modifies registry class 1 IoCs

Processes:

c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe

C:\Users\Admin\AppData\Local\Temp\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
"C:\Users\Admin\AppData\Local\Temp\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1756

C:\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe"
2⤵
- Executes dropped EXE
PID:1712

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
Filesize
360KB

MD5
435f79d364b796a4ea0b5caf24ca78bd

SHA1
b6586a1a823901e7abeb932a827a7b7648bc1d16

SHA256
770264724adaeccee8008b930327bc55d1f501ff48f4240b3c6ddfaf1738e248

SHA512
ea49f8961fa0300eaa19c5ad4b6b2749637a7285b66f9eeddbc99c4b8b3daa61a6cab7c030bc4726906fc3df916f32852ccc421fa96aba600c75a94e8cf57606

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\c5736dc1d870791ee98c77c6c845bb2a1b04eb5e23bcab7cc52f1d98ef251dc5.exe
Filesize
360KB

MD5
435f79d364b796a4ea0b5caf24ca78bd

SHA1
b6586a1a823901e7abeb932a827a7b7648bc1d16

SHA256
770264724adaeccee8008b930327bc55d1f501ff48f4240b3c6ddfaf1738e248

SHA512
ea49f8961fa0300eaa19c5ad4b6b2749637a7285b66f9eeddbc99c4b8b3daa61a6cab7c030bc4726906fc3df916f32852ccc421fa96aba600c75a94e8cf57606

Download Submit
memory/1712-57-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1756-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads