Overview

overview

10

Static

static

10

90ccc954f4...1b.exe

windows7-x64

10

90ccc954f4...1b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 02:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe

  • Size

    137KB

  • MD5

    13ad7a2ea9b4364b1c1d68033bae3b5e

  • SHA1

    7e6b9d51941bb24dd3104d13d852dc068b5be848

  • SHA256

    90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b

  • SHA512

    8ff13ab209ab3956e71dd485c04ec9a36375f5a1c803a004b0f9ebb2d2014bb55b444af07429a6381b2a21689cb022410bbab5bffacb3c5454ac6e0d8870bd10

  • SSDEEP

    3072:sr85CQPowYJE+OjioVknZE8/HK52+f9W9TPyYPowYJE+OjioVknZE8/HK5W:k9idioV0r/WR9t6dioV0r/WW

Score
10/10
neshtapersistencespywarestealer

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe
    "C:\Users\Admin\AppData\Local\Temp\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\3582-490\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3582-490\DNS.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /flushdnsipconfig/releaseipconfig/renew
          4⤵
          • Gathers network information
          PID:3600
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1340
        3⤵
        • Program crash
        PID:1276
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1660 -ip 1660
    1⤵
      PID:748

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe
      Filesize

      96KB

      MD5

      eb9e93957687314c8beb7f653d971286

      SHA1

      fd9bc5ed8f90d66a58d7d46185ba8b037d8c5558

      SHA256

      06fe78ca204b9b9027af20f5456d0cfec8e654375ee23030203948075315b6c9

      SHA512

      11b213570151b42f0a1ecad24a7d35a33085707e03375075eec7c93f5acbf88beaf5cd8ffa65f0e3e2e788cc74ceef9e69e7955f04672c2f82d0292dfa14fee9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\90ccc954f4224b2160f2a626ea28c5aa524a2e8dc5c8c0f47d67776fb9ee4d1b.exe
      Filesize

      96KB

      MD5

      eb9e93957687314c8beb7f653d971286

      SHA1

      fd9bc5ed8f90d66a58d7d46185ba8b037d8c5558

      SHA256

      06fe78ca204b9b9027af20f5456d0cfec8e654375ee23030203948075315b6c9

      SHA512

      11b213570151b42f0a1ecad24a7d35a33085707e03375075eec7c93f5acbf88beaf5cd8ffa65f0e3e2e788cc74ceef9e69e7955f04672c2f82d0292dfa14fee9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\DNS.bat
      Filesize

      47B

      MD5

      4b403bd7ff6fe021fcf3ecdd2c029f87

      SHA1

      890642fc02dbfffd5d3aef0ec652fa636a48c3ee

      SHA256

      267c9197388ab6b34c7516e728a3529df2b7aab5029588ffb47540bbe651f654

      SHA512

      3bdef29cfeab451d45182420bd179f9450a0da5c842992260a420728e212635f90cc1f394687c8ac852ccd8caf529e9bdb4aff24e2d07f6705594931b3ef5e6d

      Download Submit

    • memory/1660-132-0x0000000000000000-mapping.dmp

      Download

    • memory/1660-135-0x0000000000630000-0x000000000064E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1660-136-0x0000000004F90000-0x000000000502C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1660-137-0x0000000005850000-0x0000000005DF4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3600-140-0x0000000000000000-mapping.dmp

      Download

    • memory/4220-138-0x0000000000000000-mapping.dmp

      Download