neshta | c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3

General

Target

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
Size

1.2MB
MD5

778ba1fa75c485d94d343facff0c9f95
SHA1

a4284cccd85c4b707fb00f6607d89b2b0a288f40
SHA256

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3
SHA512

b547ac4d2d5a874ff1d04dc4aa6046bc7107216cb6f135a85c3b0d9520aa06ab17415f1d7ed120c5627cdb8fc438fdd6fae113a50d5feca1d5af87ec31e5c745
SSDEEP

12288:MlcZK8qBwbfrvUI+qj2poXJ8t/sGXAm903IYLH6voaJtz:9K8qwf7Utk2poXJ8tEGXAm94PLHAtJ9

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

pid process

528 c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

pid	process
528	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Drops file in Windows directory 1 IoCs

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description ioc process

File opened for modification C:\Windows\svchost.com c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4824 528 WerFault.exe c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

pid	pid_target	process	target process
4824	528	WerFault.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Modifies registry class 1 IoCs

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

description	pid	process	target process
PID 2228 wrote to memory of 528	2228	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
PID 2228 wrote to memory of 528	2228	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe	c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe

C:\Users\Admin\AppData\Local\Temp\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
"C:\Users\Admin\AppData\Local\Temp\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\3582-490\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe"
2⤵
- Executes dropped EXE
PID:528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 528 -s 544
3⤵
- Program crash
PID:4824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 528 -ip 528
1⤵
PID:4800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
Filesize
1.1MB

MD5
c326862e222ac7998e1f5491ca510e87

SHA1
8a636e13336fac3068b98bc5562a182bd5823b31

SHA256
2a5e1b3efcaf807b9fce94c655eb88f8f6d2c7ff3bd11c5e30ee821ff0c9b236

SHA512
5db82bbfabae527c74b062d7fbb4041b283ebbf2d7c26ac8e801992478e31b423bfd4358f31e0005200bff462b4922e6e306bad23a1dc84401960805b625829d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c1fdd300b01a24052da454295afed738f00d6aa28d2383bd9af4ff03736851c3.exe
Filesize
1.1MB

MD5
c326862e222ac7998e1f5491ca510e87

SHA1
8a636e13336fac3068b98bc5562a182bd5823b31

SHA256
2a5e1b3efcaf807b9fce94c655eb88f8f6d2c7ff3bd11c5e30ee821ff0c9b236

SHA512
5db82bbfabae527c74b062d7fbb4041b283ebbf2d7c26ac8e801992478e31b423bfd4358f31e0005200bff462b4922e6e306bad23a1dc84401960805b625829d

Download Submit
memory/528-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads