neshta | e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b

General

Target

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Size

240KB
MD5

2c2bfeb1570ca4c967b35e1ec4258120
SHA1

3d9163169b1f720b4cf376e874a8301ebed3b3cc
SHA256

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b
SHA512

02845962616c583ededed2a8478d0179396d11d9e077673fd8adabce0bec245effec0c0c0c1558550fcfe20af06fdbd3be0adc9cc3b2bb77292fd421a5fb801a
SSDEEP

6144:k9usRwlH2/8UcR10g+YLLwSOQ6ZmkWkr9eZXW:Zow2/8UcH0yLL/OkBS9eZXW

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid process

3472 e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~4.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MI391D~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~3.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MI9C33~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~2.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Drops file in Windows directory 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description ioc process

File opened for modification C:\Windows\svchost.com e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Modifies registry class 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid	process
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid	process
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
3472	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	pid	process	target process
PID 2900 wrote to memory of 3472	2900	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 2900 wrote to memory of 3472	2900	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 2900 wrote to memory of 3472	2900	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

C:\Users\Admin\AppData\Local\Temp\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
"C:\Users\Admin\AppData\Local\Temp\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Filesize
200KB

MD5
0364c992a9016ca485d525057f4b198a

SHA1
ee659561ddc81c8380dd3cda86b2bd0f5c1ca77c

SHA256
2a1f5d8842b642892c4e2075a7ba0e4a1602f0f759a3a3816859aa7633d63bbd

SHA512
f7d24eb9f5f9e4228c5161690fbf6ef25756ce8756fcca3638f5e0af20db6b1437e9a3dfd688ac3c8923e8313fc584179e9c5431ad71b612977e01b706381cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Filesize
200KB

MD5
0364c992a9016ca485d525057f4b198a

SHA1
ee659561ddc81c8380dd3cda86b2bd0f5c1ca77c

SHA256
2a1f5d8842b642892c4e2075a7ba0e4a1602f0f759a3a3816859aa7633d63bbd

SHA512
f7d24eb9f5f9e4228c5161690fbf6ef25756ce8756fcca3638f5e0af20db6b1437e9a3dfd688ac3c8923e8313fc584179e9c5431ad71b612977e01b706381cd1

Download Submit
memory/3472-132-0x0000000000000000-mapping.dmp

Download
memory/3472-135-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3472-136-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads