neshta | b573da110968bb8dcdb3adf3976a9092ecf19720aa2080cdb8827ef85718acde

General

Target

fddae97e46bc44f1c9d6eaf505603f2f.exe
Size

423KB
MD5

fddae97e46bc44f1c9d6eaf505603f2f
SHA1

1f9b80c74e19b9ef88702dad2f11d5821910c01a
SHA256

b573da110968bb8dcdb3adf3976a9092ecf19720aa2080cdb8827ef85718acde
SHA512

9d1c93700e4783db0ee0c21152d760debf1c2f12ebd75b7b7e1ea7cb84bbc1f7955a8cba595352379ae41252774495bb9aa115e68c16f2c3a5fa81ba99bdb16d
SSDEEP

6144:k9YtQgR1sXtBqJmenoCTMKj+W1PmFuy3gVb222cg9iu7PpswtmF7HOT3xE:Btn0Bts7CWWumgkBFtmF7uLxE

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fddae97e46bc44f1c9d6eaf505603f2f.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

pid process

524 fddae97e46bc44f1c9d6eaf505603f2f.exe
Loads dropped DLL 3 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

pid process

856 fddae97e46bc44f1c9d6eaf505603f2f.exe
856 fddae97e46bc44f1c9d6eaf505603f2f.exe
856 fddae97e46bc44f1c9d6eaf505603f2f.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
524	fddae97e46bc44f1c9d6eaf505603f2f.exe

pid	process
856	fddae97e46bc44f1c9d6eaf505603f2f.exe
856	fddae97e46bc44f1c9d6eaf505603f2f.exe
856	fddae97e46bc44f1c9d6eaf505603f2f.exe

Drops file in Program Files directory 64 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe

Drops file in Windows directory 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description ioc process

File opened for modification C:\Windows\svchost.com fddae97e46bc44f1c9d6eaf505603f2f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	fddae97e46bc44f1c9d6eaf505603f2f.exe

Modifies registry class 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fddae97e46bc44f1c9d6eaf505603f2f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	pid	process	target process
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 856 wrote to memory of 524	856	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe

C:\Users\Admin\AppData\Local\Temp\fddae97e46bc44f1c9d6eaf505603f2f.exe
"C:\Users\Admin\AppData\Local\Temp\fddae97e46bc44f1c9d6eaf505603f2f.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe"
2⤵
- Executes dropped EXE
PID:524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
memory/524-57-0x0000000000000000-mapping.dmp

Download
memory/856-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads