neshta | 3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d

General

Target

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
Size

850KB
MD5

1e6bbe9cc2fe6d64457ab5a8bd61d181
SHA1

cc9620887a85a8f80d0fa3353ef77398111fadf6
SHA256

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d
SHA512

c1b6943662f22f013f8debf7ef3e70cb87f6d9814b92722c138a1982ffdeda901dab85212cda4400d0b00ce20fd537e224906fda0748e720d141f970cee0655e
SSDEEP

12288:RnbuFP8qrHtOZgcaHgkCyz114d96Gv6knCUnDelclIV03ykMDu:AFkvZ6CQO36Gv6knCUe1Du

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

pid process

840 3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

pid	process
840	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Loads dropped DLL 3 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

pid	process
1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Drops file in Windows directory 1 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

description ioc process

File opened for modification C:\Windows\svchost.com 3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Modifies registry class 1 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

pid process

840 3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

pid	process
840	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

description	pid	process	target process
PID 1744 wrote to memory of 840	1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
PID 1744 wrote to memory of 840	1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
PID 1744 wrote to memory of 840	1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
PID 1744 wrote to memory of 840	1744	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe	3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe

C:\Users\Admin\AppData\Local\Temp\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
"C:\Users\Admin\AppData\Local\Temp\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\3582-490\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
Filesize
810KB

MD5
30d469b9782f47944adabd7e2a5c8f43

SHA1
263de3c112d04df98d346007124ed69ba731ef28

SHA256
d5b0c1b6ea5b4c7e04b9bd12a4f5e5f33b833178957bca11d30eb3151bce65ed

SHA512
876b475d19afd0a2c0e0b3527e1577e5ce2de9cfceb93cab529edba759f75c0267297cab8986d40172cc1eb78c3aaaadbdebc5d1aa53e9f9f950873f4efb5714

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
Filesize
810KB

MD5
30d469b9782f47944adabd7e2a5c8f43

SHA1
263de3c112d04df98d346007124ed69ba731ef28

SHA256
d5b0c1b6ea5b4c7e04b9bd12a4f5e5f33b833178957bca11d30eb3151bce65ed

SHA512
876b475d19afd0a2c0e0b3527e1577e5ce2de9cfceb93cab529edba759f75c0267297cab8986d40172cc1eb78c3aaaadbdebc5d1aa53e9f9f950873f4efb5714

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\3bf0c18fb6fdc4981fd4c16a0bee89fe07690168671b507b0e45ad8d324c866d.exe
Filesize
810KB

MD5
30d469b9782f47944adabd7e2a5c8f43

SHA1
263de3c112d04df98d346007124ed69ba731ef28

SHA256
d5b0c1b6ea5b4c7e04b9bd12a4f5e5f33b833178957bca11d30eb3151bce65ed

SHA512
876b475d19afd0a2c0e0b3527e1577e5ce2de9cfceb93cab529edba759f75c0267297cab8986d40172cc1eb78c3aaaadbdebc5d1aa53e9f9f950873f4efb5714

Download Submit
memory/840-57-0x0000000000000000-mapping.dmp

Download
memory/1744-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads