neshta | 99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2

General

Target

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
Size

84KB
MD5

b8fa91f2cf84b3275b839993a2eebe39
SHA1

92b087a2904332374b47fad62ed830512ae7e302
SHA256

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2
SHA512

fa566cdadf7245e7a73ab0fcb1ab3e6df50b7cd67858eebf988058de866261b900690b33a45ee1a69bcf48a31a9c5e00349a8814d6018aa3e821751db0398d1c
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJRH0nbnD/fSDWQNAKnnnvbzyA86dOCZu:JxqjQ+P04wsmJCYHLWQCKvbO760

Score

10^/10

neshta evasion persistence spyware

Malware Config

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 3 IoCs

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exesvchost.comgoogle.exe

pid process

2288 99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
3100 svchost.com
4204 google.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4624 netsh.exe

pid	process
2288	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
3100	svchost.com
4204	google.exe

pid	process
4624	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

Drops startup file 2 IoCs

Processes:

google.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\85ce27c90f0ba2b98ceb888e2ca7acde.exe	google.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\85ce27c90f0ba2b98ceb888e2ca7acde.exe	google.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

google.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\85ce27c90f0ba2b98ceb888e2ca7acde = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\85ce27c90f0ba2b98ceb888e2ca7acde = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe

Drops file in Program Files directory 28 IoCs

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

Drops file in Windows directory 3 IoCs

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exesvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

google.exe

pid	process
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe
4204	google.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

google.exe

description pid process

Token: SeDebugPrivilege 4204 google.exe

description	pid	process
Token: SeDebugPrivilege	4204	google.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exesvchost.comgoogle.exe

description	pid	process	target process
PID 2132 wrote to memory of 2288	2132	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
PID 2132 wrote to memory of 2288	2132	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
PID 2132 wrote to memory of 2288	2132	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
PID 2288 wrote to memory of 3100	2288	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	svchost.com
PID 2288 wrote to memory of 3100	2288	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	svchost.com
PID 2288 wrote to memory of 3100	2288	99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe	svchost.com
PID 3100 wrote to memory of 4204	3100	svchost.com	google.exe
PID 3100 wrote to memory of 4204	3100	svchost.com	google.exe
PID 3100 wrote to memory of 4204	3100	svchost.com	google.exe
PID 4204 wrote to memory of 4624	4204	google.exe	netsh.exe
PID 4204 wrote to memory of 4624	4204	google.exe	netsh.exe
PID 4204 wrote to memory of 4624	4204	google.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
"C:\Users\Admin\AppData\Local\Temp\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132

C:\Users\Admin\AppData\Local\Temp\3582-490\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\google.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3100

C:\Users\Admin\AppData\Local\Temp\google.exe
C:\Users\Admin\AppData\Local\Temp\google.exe
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
Filesize
43KB

MD5
7b8b24186ba7b24a925eead881ba86e6

SHA1
e7d26a810aaa85bac0cebf5e38ff1d005be1898a

SHA256
700ba6e898fbb0287ced6294adbe39b9b1de5e1cb65f63e9a84b9156e63a9f8e

SHA512
9cc078f6d4134da89c1efa1811a2778018c5beb46b2d3ad350ee8c537d728e020bc7d290d195c0d24f835f6b41ba9ab4839949b85f79e510f27714266bfc2d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\99cb1bc47ef388f6c2768f9e256d024108d53edf95e32c7f55283c98338cb5f2.exe
Filesize
43KB

MD5
7b8b24186ba7b24a925eead881ba86e6

SHA1
e7d26a810aaa85bac0cebf5e38ff1d005be1898a

SHA256
700ba6e898fbb0287ced6294adbe39b9b1de5e1cb65f63e9a84b9156e63a9f8e

SHA512
9cc078f6d4134da89c1efa1811a2778018c5beb46b2d3ad350ee8c537d728e020bc7d290d195c0d24f835f6b41ba9ab4839949b85f79e510f27714266bfc2d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\google.exe
Filesize
43KB

MD5
7b8b24186ba7b24a925eead881ba86e6

SHA1
e7d26a810aaa85bac0cebf5e38ff1d005be1898a

SHA256
700ba6e898fbb0287ced6294adbe39b9b1de5e1cb65f63e9a84b9156e63a9f8e

SHA512
9cc078f6d4134da89c1efa1811a2778018c5beb46b2d3ad350ee8c537d728e020bc7d290d195c0d24f835f6b41ba9ab4839949b85f79e510f27714266bfc2d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\google.exe
Filesize
43KB

MD5
7b8b24186ba7b24a925eead881ba86e6

SHA1
e7d26a810aaa85bac0cebf5e38ff1d005be1898a

SHA256
700ba6e898fbb0287ced6294adbe39b9b1de5e1cb65f63e9a84b9156e63a9f8e

SHA512
9cc078f6d4134da89c1efa1811a2778018c5beb46b2d3ad350ee8c537d728e020bc7d290d195c0d24f835f6b41ba9ab4839949b85f79e510f27714266bfc2d89

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\odt\OFFICE~1.EXE
Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
memory/2288-135-0x0000000073A90000-0x0000000074041000-memory.dmp

Filesize
5.7MB

Download
memory/2288-143-0x0000000073A90000-0x0000000074041000-memory.dmp

Filesize
5.7MB

Download
memory/2288-132-0x0000000000000000-mapping.dmp

Download
memory/3100-136-0x0000000000000000-mapping.dmp

Download
memory/4204-140-0x0000000000000000-mapping.dmp

Download
memory/4204-144-0x0000000073A90000-0x0000000074041000-memory.dmp

Filesize
5.7MB

Download
memory/4204-145-0x0000000073A90000-0x0000000074041000-memory.dmp

Filesize
5.7MB

Download
memory/4624-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads