neshta | 80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5

Analysis

max time kernel
328s
max time network
375s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
Size

477KB
MD5

5e2880380917152d5529f9d04d162e60
SHA1

282c29511128c58dd4cd33a6c18977836476983a
SHA256

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5
SHA512

48d153d00ca2936536966b39ec90c88afed7d7cec396396ce0084dfc44e2c43365ee4f8d39a70fb7cf9874900650e626a4bdc59f74932f9380c5ebb5d341d236
SSDEEP

3072:sr85C+QDhfhxNeVbzdz5cuQrGafT3IBj1e:k9+sOFz5XPe

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

pid process

3884 80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

pid	process
3884	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

Drops file in Windows directory 1 IoCs

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

description ioc process

File opened for modification C:\Windows\svchost.com 80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

Modifies registry class 1 IoCs

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

description	pid	process	target process
PID 1452 wrote to memory of 3884	1452	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
PID 1452 wrote to memory of 3884	1452	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
PID 1452 wrote to memory of 3884	1452	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe	80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe

C:\Users\Admin\AppData\Local\Temp\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
"C:\Users\Admin\AppData\Local\Temp\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\3582-490\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe"
2⤵
- Executes dropped EXE
PID:3884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
Filesize
436KB

MD5
ab9af3c7dab4a46f3fc7569bceacdebf

SHA1
2e1e9b99a555e58cd3db6b5f17f3f7be4dfcf16f

SHA256
525288c0695113cbe04972eb77d5b8330fad6826ea436a4af53a40fe76f46f78

SHA512
bd48a5b525b38b5df12d5edef71b9eea5edaad910e0a0e56953d36bff1741b47e12e19fd13f0a8c2b0e16ab86fe7476f2d10949ace59392bd29d2af8eed733ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\80c9aba6c201c841e68bfe120482a40ba600d5ba159af2d3636ac7e9f4d9dad5.exe
Filesize
436KB

MD5
ab9af3c7dab4a46f3fc7569bceacdebf

SHA1
2e1e9b99a555e58cd3db6b5f17f3f7be4dfcf16f

SHA256
525288c0695113cbe04972eb77d5b8330fad6826ea436a4af53a40fe76f46f78

SHA512
bd48a5b525b38b5df12d5edef71b9eea5edaad910e0a0e56953d36bff1741b47e12e19fd13f0a8c2b0e16ab86fe7476f2d10949ace59392bd29d2af8eed733ae

Download Submit
memory/3884-132-0x0000000000000000-mapping.dmp

Download