neshta | 6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838

General

Target

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
Size

202KB
MD5

7d25f3c8479bd92a159f3a5baff85ad0
SHA1

ac5a45cbd37eb862de9ae87229319feb9e07fb2c
SHA256

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838
SHA512

ea3b33fc031e30dc380ceafecae99ae2f9d4cb469b04cb046c076dd74d9b014fc17bd06af3433200a917464b06bfb0625c8a3ed8318fef8431735f865657e04d
SSDEEP

3072:sr85Cv5KwJex+nHFtloFc4eaivCKVAi+owpx6r2hlhBwwoTGCVY6zB:k9v5KwQ0nl/21owX6YfqNTfVfzB

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

pid process

1616 6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

pid	process
1616	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Loads dropped DLL 2 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

pid	process
1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Drops file in Windows directory 1 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

description ioc process

File opened for modification C:\Windows\svchost.com 6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Modifies registry class 1 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

description	pid	process	target process
PID 1404 wrote to memory of 1616	1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
PID 1404 wrote to memory of 1616	1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
PID 1404 wrote to memory of 1616	1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
PID 1404 wrote to memory of 1616	1404	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe	6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe

C:\Users\Admin\AppData\Local\Temp\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
"C:\Users\Admin\AppData\Local\Temp\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\3582-490\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe"
2⤵
- Executes dropped EXE
PID:1616

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
Filesize
161KB

MD5
55224509d4a4e1214676aec9d49759c7

SHA1
9adc5aaefaeeec136d8370a3237254468a5a1d93

SHA256
4a8e28ea329ea13bf7a180dc1ea60f5311ca906a235857dc7debc8ac80bb7c80

SHA512
1dad3c094f52d126a7c08e30b43cb5b00a90c293c0f6a7c72e8f22f1f1826bf9fc81280c4c0faa04b704f604a726bc79fd968c8fa6113466b27d938e16ee4d41

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\6e8f33fe7ad51c7640b5fdc03925ab93d6b3cf978f8548c609c622c4e809c838.exe
Filesize
161KB

MD5
55224509d4a4e1214676aec9d49759c7

SHA1
9adc5aaefaeeec136d8370a3237254468a5a1d93

SHA256
4a8e28ea329ea13bf7a180dc1ea60f5311ca906a235857dc7debc8ac80bb7c80

SHA512
1dad3c094f52d126a7c08e30b43cb5b00a90c293c0f6a7c72e8f22f1f1826bf9fc81280c4c0faa04b704f604a726bc79fd968c8fa6113466b27d938e16ee4d41

Download Submit
memory/1404-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1616-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads