neshta | 83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040

General

Target

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
Size

40KB
MD5

09e4f5358efe2ce703bad7b45aee945d
SHA1

948926814b285d5159c5b544f12bb0597aec9813
SHA256

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040
SHA512

487d6bac6cbf12e6d8c48f4f036117de26ebed584f00fa84df1d5995014404064443896d1e54bb8c45a222ecf1ffccb7c137b2d8723a8a9d076c38708d3977cb
SSDEEP

768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJkcx:yxqjQ+P04wsZLnDrCT

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MI9C33~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MIA062~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MI391D~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~3.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~2.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

Drops file in Windows directory 1 IoCs

Processes:

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

description ioc process

File opened for modification C:\Windows\svchost.com 83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

Modifies registry class 1 IoCs

Processes:

83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe

C:\Users\Admin\AppData\Local\Temp\83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe
"C:\Users\Admin\AppData\Local\Temp\83acd7edefebfb2b89009365c3ccd0aa3f2e4530aafe19516a41ed7b026a2040.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:876