neshta | 29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336

General

Target

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
Size

407KB
MD5

2d6d23ed64234f5c39a7e9cf5d70783b
SHA1

4eebd3a940b91fc3fbe2165d5d6b20fc6b679b0e
SHA256

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336
SHA512

c180a4547aaaa2630eec6cbda9258e0b9b2419ef3eefdca4204a41969ae87862cf5bc0edf3b02de30b3e464407b46269625cdf3aed8830282e31d277b91f7358
SSDEEP

6144:k9nVR5ie6dCYm8EZs444DUGYBWWYLDeZ8oQeVR5ie6dCYm8EZs444DUGYBgDeZ87:wLr0eWae3LL0Mes

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

pid process

2320 29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

pid	process
2320	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\INSTAL~1\setup.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\NOTIFI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~3.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\COOKIE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\ELEVAT~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\msedge.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\PWAHEL~1.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Drops file in Windows directory 1 IoCs

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description ioc process

File opened for modification C:\Windows\svchost.com 29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Modifies registry class 1 IoCs

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

description	pid	process	target process
PID 4800 wrote to memory of 2320	4800	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
PID 4800 wrote to memory of 2320	4800	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
PID 4800 wrote to memory of 2320	4800	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe	29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe

C:\Users\Admin\AppData\Local\Temp\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
"C:\Users\Admin\AppData\Local\Temp\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\3582-490\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe"
2⤵
- Executes dropped EXE
PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
Filesize
367KB

MD5
cfcf891aeee70bb25e86f7eaa53ee1b6

SHA1
43c3c1f3f3fd7d10c3736af73850a3cab0f10324

SHA256
b463289ed818abee24725639dc05a4e64cff9e8b430bc61784d105a31c29b5cc

SHA512
c2e2328fc4b9debcb152ac7af400956ee0988b9d3fff77bdde00865e90e24619be33a24d7c330f0a81beaf11e7fa868060fe74d12aa04442e600f60899e05e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\29d1904dab636d43b32ac639825c3b0666400b51aae1253000119692d3ab4336.exe
Filesize
367KB

MD5
cfcf891aeee70bb25e86f7eaa53ee1b6

SHA1
43c3c1f3f3fd7d10c3736af73850a3cab0f10324

SHA256
b463289ed818abee24725639dc05a4e64cff9e8b430bc61784d105a31c29b5cc

SHA512
c2e2328fc4b9debcb152ac7af400956ee0988b9d3fff77bdde00865e90e24619be33a24d7c330f0a81beaf11e7fa868060fe74d12aa04442e600f60899e05e06

Download Submit
memory/2320-132-0x0000000000000000-mapping.dmp

Download
memory/2320-135-0x0000000000FF0000-0x0000000001052000-memory.dmp

Filesize
392KB

Download
memory/2320-136-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Filesize
624KB

Download
memory/2320-137-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/2320-138-0x0000000005AF0000-0x0000000005B82000-memory.dmp

Filesize
584KB

Download
memory/2320-139-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Filesize
40KB

Download
memory/2320-140-0x0000000005CE0000-0x0000000005D36000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads