neshta | 2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2

Analysis

max time kernel
150s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Size

376KB
MD5

083af8cf1a2c756d15bb432b2e32e174
SHA1

ee0d74aa436d228cd2e2d9c77f15bd43b28e4bc4
SHA256

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2
SHA512

a2e5c961dc6b65264c05f98c88f0152926c4091194e700465dbb254b919b0a73249ae44bf875ba1a8e36ed62fa34efca1844378c06dfdb9c395bda496b3015d1
SSDEEP

6144:k94fEDUdt9eQn5r75fJ7RmGHFuxRHUQjf8XFq2mLEXzo+jMd:jf9dt9eQn9HL8R00WFq5P3

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 30 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{4AEAC~1\MicrosoftEdgeUpdateSetup_X86_1.3.169.31.exe	family_neshta
C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 3 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exesvchost.comSTEAMW~1.EXE

pid process

4004 2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
4564 svchost.com
4544 STEAMW~1.EXE

pid	process
4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
4564	svchost.com
4544	STEAMW~1.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exeSTEAMW~1.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	STEAMW~1.EXE

Drops file in Program Files directory 64 IoCs

Processes:

svchost.com2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13169~1.31\MICROS~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MIA062~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MIA062~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~4.EXE	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

Drops file in Windows directory 3 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exesvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exeSTEAMW~1.EXE

pid process

4004 2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
4544 STEAMW~1.EXE

pid	process
4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
4544	STEAMW~1.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exeSTEAMW~1.EXE

description	pid	process
Token: SeDebugPrivilege	4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Token: SeDebugPrivilege	4544	STEAMW~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exesvchost.com

description	pid	process	target process
PID 344 wrote to memory of 4004	344	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
PID 344 wrote to memory of 4004	344	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
PID 4004 wrote to memory of 4564	4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe	svchost.com
PID 4004 wrote to memory of 4564	4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe	svchost.com
PID 4004 wrote to memory of 4564	4004	2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe	svchost.com
PID 4564 wrote to memory of 4544	4564	svchost.com	STEAMW~1.EXE
PID 4564 wrote to memory of 4544	4564	svchost.com	STEAMW~1.EXE

C:\Users\Admin\AppData\Local\Temp\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
"C:\Users\Admin\AppData\Local\Temp\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Local\Temp\3582-490\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\STEAMW~1\STEAMW~1.EXE"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Roaming\STEAMW~1\STEAMW~1.EXE
C:\Users\Admin\AppData\Roaming\STEAMW~1\STEAMW~1.EXE
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Filesize
368KB

MD5
a344438de9e499ca3d9038688440f406

SHA1
c961917349de7e9d269f6f4a5593b6b9d3fcd4d2

SHA256
715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557

SHA512
8bf3c621725fddafa6326b057fee9beee95966e43c5fbab40ebaa4a1a64d17acca97a19d0ece10c3574e13e194ff191316871d1d46d4d74ffc0ac3efb403bca9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Filesize
127KB

MD5
02c064bea2cf9da44904c9a1ecb61c48

SHA1
75b874030dc2300f6663ba70e3bb5b4475e4b89c

SHA256
3ed504ee3804fdd067bf02599ae9d41ef0f795f9f6f5ae1038e25578d0230f0a

SHA512
fb8aa2bba96efa28fd56ccf5bb0d2505c13d4b98740ad3f5c1b8b0ea131ebd4f9e9822d259e9c96ec595c5843f908f12b51880a8d4c366721591e89c830a5ce8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Filesize
175KB

MD5
576410de51e63c3b5442540c8fdacbee

SHA1
8de673b679e0fee6e460cbf4f21ab728e41e0973

SHA256
3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

SHA512
f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Filesize
2.5MB

MD5
316cf123fc3021e85e4a3cb3d703e83e

SHA1
0bc76376a2ee11616aacfe6284acb94bcb23c62d

SHA256
9b5ffbf037621537fe7769e01d0faffd042010b2019ce657b2d2419fd0e1db8e

SHA512
ed0b5a4201d8f32e37a67477327996fc45ebd806057d3873012a2683e6f2170e50439f5ef5edcd15d1600d8313b70964d3a39f1151af32391bdac48da875278a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Filesize
183KB

MD5
9dfcdd1ab508b26917bb2461488d8605

SHA1
4ba6342bcf4942ade05fb12db83da89dc8c56a21

SHA256
ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

SHA512
1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Filesize
92KB

MD5
176436d406fd1aabebae353963b3ebcf

SHA1
9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

SHA256
2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

SHA512
a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Filesize
125KB

MD5
cce8964848413b49f18a44da9cb0a79b

SHA1
0b7452100d400acebb1c1887542f322a92cbd7ae

SHA256
fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

SHA512
bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Filesize
278KB

MD5
12c29dd57aa69f45ddd2e47620e0a8d9

SHA1
ba297aa3fe237ca916257bc46370b360a2db2223

SHA256
22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

SHA512
255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Filesize
507KB

MD5
5e6a868a68e9773762f69a8ff5b31aec

SHA1
89e35086845e3f0318651eaf17cd582c83801b89

SHA256
9c37d3f5a2a2585b7944179a7aec31c53b313877be0928267b176a3193c246ac

SHA512
9dbf59e29e547b56ff1a3e4c40ffb5b437682cb15c9b4c3f1ef4ce63fd4eaa827dd71c44b5cf695943ad0392f0486ffec0cdcc1819417422a5644a1dcd936c5a

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
Filesize
138KB

MD5
fafb18b930b2b05ac8c5ddb988e9062f

SHA1
825ea5069601fb875f8d050aa01300eac03d3826

SHA256
c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265

SHA512
be034e7377bd27092aad02e13a152fb80ff74c1ba2fb63ccb344cd55315d115ee47e46727cbe55ca808efafa58d7924e3eed965e9a2fd3b9ae2dff7834383e54

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE
Filesize
231KB

MD5
2a226fd810c5ce7b825ff7982bc22a0b

SHA1
58be5cb790336a8e751e91b1702a87fc0521a1d8

SHA256
af9e01dab96c2a54e2751a0d703cc55fdcc5ac00c40f0be2e13fd85c09b66132

SHA512
f122ce37b07871b88e322b0ca2e42f3170704d4165167d6d7b02883da9d2be5d2d62bdbd9f7e18d1c0c5e60e9e707a3b64ddb99150c99028333818dfa769deeb

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
Filesize
326KB

MD5
09f0c144ff13cebc21267e71326324e7

SHA1
338ca67ba76427c48aace86ad68b780eb38a252d

SHA256
56977618a0fbd66c0ef0ca042290dfe464f4ad5b4b737a4b9db47631a7178f13

SHA512
126ed94d3efd7aa54b181ffe35be6dbe6aea1481eaf28f6f418a23717d052e3d53e49c1de8f7aa68120f9be9b84e965ab5ccf3b0f0a1b25de6321217d67e6284

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE
Filesize
404KB

MD5
ea78ed9e7eb4cc64544163627476fe4b

SHA1
67aed91a59742a36c0ff635b15c692cde3eb3a9d

SHA256
d5adfd6c8160892716ad5f2907cc66888aee97e1d296404503e1d42dd30ba562

SHA512
eeee54e5ffbd243fe7ef6c93744c754bc238e5b05e85c7ca3b25edc02a8692cd10225edff40444fe2536608d0ed25578573e309503cb8f90f43d089d86f8710f

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{4AEAC~1\MicrosoftEdgeUpdateSetup_X86_1.3.169.31.exe
Filesize
1.6MB

MD5
78a1924e61cb0c678948fde19179a0ac

SHA1
daec7c0a4efa5169df87136aadee8b2148f9734a

SHA256
92084522b9dac1cddb528dfeeabca85f46c19c6965d8ceb2295c6323c4e83b5c

SHA512
a19653683b6ce819893342f675eec3af4d4303beec04631d7f56b1fc12ad3ff1628d73fdf702f581469a97ca8233413364b5305fc50e6e6a0c425df165e137bd

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE
Filesize
1.1MB

MD5
a5d9eaa7d52bffc494a5f58203c6c1b5

SHA1
97928ba7b61b46a1a77a38445679d040ffca7cc8

SHA256
34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48

SHA512
b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE
Filesize
1.6MB

MD5
11486d1d22eaacf01580e3e650f1da3f

SHA1
a47a721efec08ade8456a6918c3de413a2f8c7a2

SHA256
5e1b1daa9968ca19a58714617b7e691b6b6f34bfacaf0dcf4792c48888b1a5d3

SHA512
5bd54e1c1308e04a769e089ab37bd9236ab97343b486b85a018f2c8ad060503c97e8bc51f911a63f9b96dd734eb7d21e0a5c447951246d972b05fafeef4633da

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe
Filesize
3.2MB

MD5
9ccbe770dfaf7fc66e535bcfb1e25f43

SHA1
9a57d13a14c8feebaa72592b05f56c41acba7cc5

SHA256
e1f7231e4f4bc2260a93cd1b69237786a8b6764f4637397fdb676681e66bcda9

SHA512
80a2e09bb8dcf7f9cad749cf71acebb93f6efd3913e3cedfccef7b9a59008dd55d55a237dcb7bfbab86f47ef6f3e0165e0a7987b378f536e68ec91a613f24e7b

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Filesize
1.1MB

MD5
5c78384d8eb1f6cb8cb23d515cfe7c98

SHA1
b732ab6c3fbf2ded8a4d6c8962554d119f59082e

SHA256
9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564

SHA512
99324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
Filesize
3.2MB

MD5
5119e350591269f44f732b470024bb7c

SHA1
4ccd48e4c6ba6e162d1520760ee3063e93e2c014

SHA256
2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873

SHA512
599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

Download Submit
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
Filesize
494KB

MD5
05bdfd8a3128ab14d96818f43ebe9c0e

SHA1
495cbbd020391e05d11c52aa23bdae7b89532eb7

SHA256
7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb

SHA512
8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

Download Submit
C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
Filesize
6.7MB

MD5
63dc05e27a0b43bf25f151751b481b8c

SHA1
b20321483dac62bce0aa0cef1d193d247747e189

SHA256
7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

SHA512
374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

Download Submit
C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
Filesize
495KB

MD5
9597098cfbc45fae685d9480d135ed13

SHA1
84401f03a7942a7e4fcd26e4414b227edd9b0f09

SHA256
45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

SHA512
16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
Filesize
525KB

MD5
a55d2c94c27ffe098171e6c1f296f56d

SHA1
d0c875b2721894404c9eaa07d444c0637a3cbc3b

SHA256
e81e4630b01d181fb3116e9e874eedfe1a43472bfa6d83cc24f55e78721ddf86

SHA512
13ee9041b21d4e00392aeaa5440c34301f945d9bbd4f07f831397040991eee79842a5618c1fd26ec75e7132b5da811bc9605b76b83a48355ede37a2a1c1cd6f0

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
Filesize
495KB

MD5
07e194ce831b1846111eb6c8b176c86e

SHA1
b9c83ec3b0949cb661878fb1a8b43a073e15baf1

SHA256
d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

SHA512
55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Filesize
335KB

MD5
05a7ee2530a6d500c4dd281b337885c2

SHA1
21d8862d36f77eacba1d05af97f3b5728e43a978

SHA256
3513c77c2c1c48bfb1ea3fd7af85bf93495173250868f5e5fb563811bc0f3fda

SHA512
95b9cdab855e376fae1419f76e6a3a765f887994b53cdbbf82a4c3ab358788328453b946cdadcab9c4fdd6ad6a7de7284b08bfbfa18cb5534ac961afc3ebaca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\2af191a1f9deb3ceca961b61dc7b65a91d05f97a9a49a555ccbda19bef7c19a2.exe
Filesize
335KB

MD5
05a7ee2530a6d500c4dd281b337885c2

SHA1
21d8862d36f77eacba1d05af97f3b5728e43a978

SHA256
3513c77c2c1c48bfb1ea3fd7af85bf93495173250868f5e5fb563811bc0f3fda

SHA512
95b9cdab855e376fae1419f76e6a3a765f887994b53cdbbf82a4c3ab358788328453b946cdadcab9c4fdd6ad6a7de7284b08bfbfa18cb5534ac961afc3ebaca0

Download Submit
C:\Users\Admin\AppData\Roaming\STEAMW~1\STEAMW~1.EXE
Filesize
335KB

MD5
05a7ee2530a6d500c4dd281b337885c2

SHA1
21d8862d36f77eacba1d05af97f3b5728e43a978

SHA256
3513c77c2c1c48bfb1ea3fd7af85bf93495173250868f5e5fb563811bc0f3fda

SHA512
95b9cdab855e376fae1419f76e6a3a765f887994b53cdbbf82a4c3ab358788328453b946cdadcab9c4fdd6ad6a7de7284b08bfbfa18cb5534ac961afc3ebaca0

Download Submit
C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
335KB

MD5
05a7ee2530a6d500c4dd281b337885c2

SHA1
21d8862d36f77eacba1d05af97f3b5728e43a978

SHA256
3513c77c2c1c48bfb1ea3fd7af85bf93495173250868f5e5fb563811bc0f3fda

SHA512
95b9cdab855e376fae1419f76e6a3a765f887994b53cdbbf82a4c3ab358788328453b946cdadcab9c4fdd6ad6a7de7284b08bfbfa18cb5534ac961afc3ebaca0

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
9b087fb5b26ea346c8317b9523cc13f6

SHA1
83a9a88c837821031e883b7f7d4354b466eae6bf

SHA256
eb6839bfa171372df512be8fc5bace54026019f6a52a17a213352478d041995b

SHA512
4a1b3ebb96002a735d3d7dc5780528fa4d0af9bc279978e95dc8e96d192316f58745c72935183b52cf1d1cc011925760fd241285f3c7ab5a4599bb23184761a1

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
9b087fb5b26ea346c8317b9523cc13f6

SHA1
83a9a88c837821031e883b7f7d4354b466eae6bf

SHA256
eb6839bfa171372df512be8fc5bace54026019f6a52a17a213352478d041995b

SHA512
4a1b3ebb96002a735d3d7dc5780528fa4d0af9bc279978e95dc8e96d192316f58745c72935183b52cf1d1cc011925760fd241285f3c7ab5a4599bb23184761a1

Download Submit
C:\odt\OFFICE~1.EXE
Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
memory/4004-136-0x00007FF84F8B0000-0x00007FF850371000-memory.dmp

Filesize
10.8MB

Download
memory/4004-135-0x0000000000330000-0x000000000038A000-memory.dmp

Filesize
360KB

Download
memory/4004-132-0x0000000000000000-mapping.dmp

Download
memory/4004-143-0x00007FF84F8B0000-0x00007FF850371000-memory.dmp

Filesize
10.8MB

Download
memory/4544-146-0x00007FF84F8B0000-0x00007FF850371000-memory.dmp

Filesize
10.8MB

Download
memory/4544-141-0x0000000000000000-mapping.dmp

Download
memory/4544-145-0x00007FF84F8B0000-0x00007FF850371000-memory.dmp

Filesize
10.8MB

Download
memory/4564-137-0x0000000000000000-mapping.dmp

Download