neshta | b573da110968bb8dcdb3adf3976a9092ecf19720aa2080cdb8827ef85718acde

General

Target

fddae97e46bc44f1c9d6eaf505603f2f.exe
Size

423KB
MD5

fddae97e46bc44f1c9d6eaf505603f2f
SHA1

1f9b80c74e19b9ef88702dad2f11d5821910c01a
SHA256

b573da110968bb8dcdb3adf3976a9092ecf19720aa2080cdb8827ef85718acde
SHA512

9d1c93700e4783db0ee0c21152d760debf1c2f12ebd75b7b7e1ea7cb84bbc1f7955a8cba595352379ae41252774495bb9aa115e68c16f2c3a5fa81ba99bdb16d
SSDEEP

6144:k9YtQgR1sXtBqJmenoCTMKj+W1PmFuy3gVb222cg9iu7PpswtmF7HOT3xE:Btn0Bts7CWWumgkBFtmF7uLxE

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fddae97e46bc44f1c9d6eaf505603f2f.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

pid process

1200 fddae97e46bc44f1c9d6eaf505603f2f.exe

pid	process
1200	fddae97e46bc44f1c9d6eaf505603f2f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	fddae97e46bc44f1c9d6eaf505603f2f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\BHO\IE_TO_~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~2.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\PWAHEL~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\NOTIFI~1.EXE	fddae97e46bc44f1c9d6eaf505603f2f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe

Drops file in Windows directory 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description ioc process

File opened for modification C:\Windows\svchost.com fddae97e46bc44f1c9d6eaf505603f2f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	fddae97e46bc44f1c9d6eaf505603f2f.exe

Modifies registry class 1 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fddae97e46bc44f1c9d6eaf505603f2f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fddae97e46bc44f1c9d6eaf505603f2f.exe

description	pid	process	target process
PID 3612 wrote to memory of 1200	3612	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 3612 wrote to memory of 1200	3612	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe
PID 3612 wrote to memory of 1200	3612	fddae97e46bc44f1c9d6eaf505603f2f.exe	fddae97e46bc44f1c9d6eaf505603f2f.exe

C:\Users\Admin\AppData\Local\Temp\fddae97e46bc44f1c9d6eaf505603f2f.exe
"C:\Users\Admin\AppData\Local\Temp\fddae97e46bc44f1c9d6eaf505603f2f.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe"
2⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\fddae97e46bc44f1c9d6eaf505603f2f.exe
Filesize
383KB

MD5
337a4e1f89eb83c2fc8e9f4a6cef8d77

SHA1
28f6137eb97f067be931a6b5279038aab406a61f

SHA256
d86d4211ecfd47d7fc890dfb61dd75517e399b48c543c1b1ae1b2b01cb7b6877

SHA512
e4d7b9bc3f945af255838742d04ed427ca8cca3b5bb952bf5a6cb57b414e51d1b760781f6782d6043d1d498f5859ff3ab26e0c0fc4918dfe110b9e1b7c2ad332

Download Submit
memory/1200-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads