Overview

overview

10

Static

static

10

1d4652c4be...dc.exe

windows7-x64

10

1d4652c4be...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d4652c4be48cc6672002f4cd273d850c0fb67d9edd79d12f65e82ca9e2f4bdc

  • Size

    896KB

  • Sample

    221120-n1nr9afc6v

  • MD5

    3b028c11938729ccf0b6e6b7ed0d2c98

  • SHA1

    f931b1b1c27c7e3363872eab75296caeb2a70e1a

  • SHA256

    1d4652c4be48cc6672002f4cd273d850c0fb67d9edd79d12f65e82ca9e2f4bdc

  • SHA512

    4669b38783ca9faf2aef1a1df1e5e49e2bbeb453ef4d5039bfa734f0a40becb472713fbe4551c2b3af67adcb95c9f9f0a3b4edb427d0f74070bc0d88c9e9f6ed

  • SSDEEP

    12288:L60d9NVns6l79Ieyv0S0rzokaGbbbbbDDDbDu:Lfdvts6HI1NHkaGbbbbbDDDbDu

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Targets

    • Target

      1d4652c4be48cc6672002f4cd273d850c0fb67d9edd79d12f65e82ca9e2f4bdc

    • Size

      896KB

    • MD5

      3b028c11938729ccf0b6e6b7ed0d2c98

    • SHA1

      f931b1b1c27c7e3363872eab75296caeb2a70e1a

    • SHA256

      1d4652c4be48cc6672002f4cd273d850c0fb67d9edd79d12f65e82ca9e2f4bdc

    • SHA512

      4669b38783ca9faf2aef1a1df1e5e49e2bbeb453ef4d5039bfa734f0a40becb472713fbe4551c2b3af67adcb95c9f9f0a3b4edb427d0f74070bc0d88c9e9f6ed

    • SSDEEP

      12288:L60d9NVns6l79Ieyv0S0rzokaGbbbbbDDDbDu:Lfdvts6HI1NHkaGbbbbbDDDbDu

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks