Analysis

  • max time kernel
    156s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 02:56

General

  • Target

    a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe

  • Size

    2.4MB

  • MD5

    16f752ca19d3c7a798b4093afed9df1a

  • SHA1

    381e68c9237ef768f7990b70e7f9bc89cb3e27d7

  • SHA256

    a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd

  • SHA512

    2483be1fd35413341fe9b497db6c47b0f9e34ab83b365bb1d755544c330e3457636c077c615cab1de56190efe323b2d911f6322250a8e1359c9fc6547e2bdbdf

  • SSDEEP

    24576:rBWN5DRRrglDngkFX2dKQ0ontRZSp8ebvYioiSeAZtlqZG+8nP+C+FiLlcsseJ+:rkQGKQ23QeS5brTnP+MN+

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe
          "C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe"
          4⤵
          • Executes dropped EXE
          PID:3108
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 12
            5⤵
            • Program crash
            PID:4744
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3108 -ip 3108
    1⤵
      PID:2680

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe

      Filesize

      2.3MB

      MD5

      13573d63ac607d9db1d9ff5f8caf16d2

      SHA1

      d3406f412e5b3fc28215656b44218bc03fd7b642

      SHA256

      070f2d3112b1859c0e825ec7147cab10ed5daf7db6ed440abfb9b6b446ec8151

      SHA512

      953ed9f3bad2286145568ee6a34b08199ec30b217e63df26a313dd64ff4ec6c64b3739278b7895e9d3cbaf2a07a45226823bbbb9ee648e50fd9f282b216dd273

    • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe

      Filesize

      2.3MB

      MD5

      13573d63ac607d9db1d9ff5f8caf16d2

      SHA1

      d3406f412e5b3fc28215656b44218bc03fd7b642

      SHA256

      070f2d3112b1859c0e825ec7147cab10ed5daf7db6ed440abfb9b6b446ec8151

      SHA512

      953ed9f3bad2286145568ee6a34b08199ec30b217e63df26a313dd64ff4ec6c64b3739278b7895e9d3cbaf2a07a45226823bbbb9ee648e50fd9f282b216dd273

    • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe

      Filesize

      2.3MB

      MD5

      13573d63ac607d9db1d9ff5f8caf16d2

      SHA1

      d3406f412e5b3fc28215656b44218bc03fd7b642

      SHA256

      070f2d3112b1859c0e825ec7147cab10ed5daf7db6ed440abfb9b6b446ec8151

      SHA512

      953ed9f3bad2286145568ee6a34b08199ec30b217e63df26a313dd64ff4ec6c64b3739278b7895e9d3cbaf2a07a45226823bbbb9ee648e50fd9f282b216dd273

    • C:\Users\Admin\AppData\Local\Temp\3582-490\a6901d34c93e5a29d47d764e238b82038c1964f9ced2e1d7798dee448c5524cd.exe

      Filesize

      2.3MB

      MD5

      13573d63ac607d9db1d9ff5f8caf16d2

      SHA1

      d3406f412e5b3fc28215656b44218bc03fd7b642

      SHA256

      070f2d3112b1859c0e825ec7147cab10ed5daf7db6ed440abfb9b6b446ec8151

      SHA512

      953ed9f3bad2286145568ee6a34b08199ec30b217e63df26a313dd64ff4ec6c64b3739278b7895e9d3cbaf2a07a45226823bbbb9ee648e50fd9f282b216dd273

    • memory/1692-132-0x0000000000000000-mapping.dmp

    • memory/3108-148-0x0000000000000000-mapping.dmp

    • memory/4008-139-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-141-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-142-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-143-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-137-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-146-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-147-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-136-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4008-135-0x0000000000000000-mapping.dmp