neshta | 163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f

General

Target

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
Size

229KB
MD5

7a9088fa597f6ac4750cff8a7a73f1f2
SHA1

adbaf9fe8988e6434e38f37218309ee9c438bb42
SHA256

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f
SHA512

9614a8d407446e0239cd5fb584849c34a2651ca9628c2cfccaab7e163ec4b9290896cf74f99edcc95d621b8ae5c66b523e00c7b8ec402a4dbbb21d2f43a51ad0
SSDEEP

3072:sr85CsP19Lhx49Z6J//sLm5Awtk8E7AljslrcujXD7HgHHh:k9sP19Lh/WpWkxAljxh

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

pid process

976 163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

pid	process
976	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Loads dropped DLL 3 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

pid	process
1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Drops file in Windows directory 2 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
File created	C:\Windows\FONTS\eudcadm.tte	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

pid process

976 163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

pid	process
976	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

description	pid	process	target process
PID 1700 wrote to memory of 976	1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
PID 1700 wrote to memory of 976	1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
PID 1700 wrote to memory of 976	1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
PID 1700 wrote to memory of 976	1700	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe	163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe

C:\Users\Admin\AppData\Local\Temp\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
"C:\Users\Admin\AppData\Local\Temp\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\3582-490\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:976

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
Filesize
188KB

MD5
799961190a2deb65b180a46f1e7aa0a6

SHA1
3d2fe33e2ea5d145c2ad08f5b6c2cc5bd56d5a69

SHA256
99fd37c1bed425b0a5687eca2da51da8b9ae4e230a4684240fd63455373b3001

SHA512
b193c34712058f94c693baf4234b87fc5e7e0c91f143f379b97f564bbf4fafa61f502b5bead5fba57f859fd81f010c11b7db095e4daedac1ff08a5d0fa70eb12

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
Filesize
188KB

MD5
799961190a2deb65b180a46f1e7aa0a6

SHA1
3d2fe33e2ea5d145c2ad08f5b6c2cc5bd56d5a69

SHA256
99fd37c1bed425b0a5687eca2da51da8b9ae4e230a4684240fd63455373b3001

SHA512
b193c34712058f94c693baf4234b87fc5e7e0c91f143f379b97f564bbf4fafa61f502b5bead5fba57f859fd81f010c11b7db095e4daedac1ff08a5d0fa70eb12

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\163e91070763ea2a9bea053991ce5e2487df3b646dc01dce16ace91f07d62d8f.exe
Filesize
188KB

MD5
799961190a2deb65b180a46f1e7aa0a6

SHA1
3d2fe33e2ea5d145c2ad08f5b6c2cc5bd56d5a69

SHA256
99fd37c1bed425b0a5687eca2da51da8b9ae4e230a4684240fd63455373b3001

SHA512
b193c34712058f94c693baf4234b87fc5e7e0c91f143f379b97f564bbf4fafa61f502b5bead5fba57f859fd81f010c11b7db095e4daedac1ff08a5d0fa70eb12

Download Submit
memory/976-57-0x0000000000000000-mapping.dmp

Download
memory/1700-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads