Analysis

  • max time kernel
    180s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2022 02:30

General

  • Target

    7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

  • Size

    554KB

  • MD5

    b64f3c2fbaa8844418d97fb813534140

  • SHA1

    14ea90c0898faa048ee724cd49ecdf1179285252

  • SHA256

    7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e

  • SHA512

    f628ec34e90be223e54b83c7afe0143ad1cb8811c2da481e94f0c625eebfd76fb3ec9338be65624be0f0eaf1db21a5ef9551892186b2ebaf055fb80174c9daaf

  • SSDEEP

    12288:wggTSWAJR0p/StdpxHHF/XWs3KI/IDdFCPn:yTjAJR0JStdpxHHF/r/IDdEn

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
    "C:\Users\Admin\AppData\Local\Temp\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe"
      2⤵
      • Executes dropped EXE
      PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
    Filesize

    513KB

    MD5

    35fba027e38455ff3d915dfd2b7e6f88

    SHA1

    d9ab135537398bfc845ae953dad1090c47f15371

    SHA256

    e4a5023310e140172f53e7a8b5639a17572a6b7f1f775382f43faa96b0818ca7

    SHA512

    1a8748235b610a89a0b3871ce63f7e4f65ed8815d80587153e3a8256a086f561164a09bf312d905b2126de5c423c7ffdeddfd606efec85f49a4a8b56ed16fd51

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • \Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
    Filesize

    513KB

    MD5

    35fba027e38455ff3d915dfd2b7e6f88

    SHA1

    d9ab135537398bfc845ae953dad1090c47f15371

    SHA256

    e4a5023310e140172f53e7a8b5639a17572a6b7f1f775382f43faa96b0818ca7

    SHA512

    1a8748235b610a89a0b3871ce63f7e4f65ed8815d80587153e3a8256a086f561164a09bf312d905b2126de5c423c7ffdeddfd606efec85f49a4a8b56ed16fd51

  • \Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
    Filesize

    513KB

    MD5

    35fba027e38455ff3d915dfd2b7e6f88

    SHA1

    d9ab135537398bfc845ae953dad1090c47f15371

    SHA256

    e4a5023310e140172f53e7a8b5639a17572a6b7f1f775382f43faa96b0818ca7

    SHA512

    1a8748235b610a89a0b3871ce63f7e4f65ed8815d80587153e3a8256a086f561164a09bf312d905b2126de5c423c7ffdeddfd606efec85f49a4a8b56ed16fd51

  • memory/268-57-0x0000000000000000-mapping.dmp
  • memory/1356-54-0x0000000075091000-0x0000000075093000-memory.dmp
    Filesize

    8KB