neshta | 5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e

Analysis

max time kernel
230s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Size

902KB
MD5

7273f96026f41369b913b5dc2d67c0d1
SHA1

7bd31f125fea63b71e7c489bcf5b79297b1deaff
SHA256

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e
SHA512

9e0b5b36122d88326c6070d68aff537015802005041815d6510f68c176eaeae44356e101d67dca337d0aab836cb6d15202bd13451880f9ffef0e04abb77f37aa
SSDEEP

24576:bTBed//xueiltlf4rHqVLL66VoGFU1m4:b4d/ZueiltOrHav6KoGF

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exeupdate.exe

pid process

1176 5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
108 update.exe

pid	process
1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
108	update.exe

Loads dropped DLL 8 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exeupdate.exe

pid	process
524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
108	update.exe
108	update.exe
108	update.exe
524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

description	ioc	process
File opened (read-only)	\??\e:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\h:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\s:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\v:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\p:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\b:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\f:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\g:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\j:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\k:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\l:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\o:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\q:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\r:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\t:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\w:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\x:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\n:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\y:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\z:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\a:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\i:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\m:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened (read-only)	\??\u:	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

Drops file in Program Files directory 64 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

Drops file in Windows directory 2 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exeupdate.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
File opened for modification	C:\Windows\Q327979.log	update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

update.exe

description	pid	process
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeBackupPrivilege	108	update.exe
Token: SeRestorePrivilege	108	update.exe
Token: SeShutdownPrivilege	108	update.exe
Token: SeSecurityPrivilege	108	update.exe
Token: SeTakeOwnershipPrivilege	108	update.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe

description	pid	process	target process
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 524 wrote to memory of 1176	524	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe
PID 1176 wrote to memory of 108	1176	5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe	update.exe

C:\Users\Admin\AppData\Local\Temp\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
"C:\Users\Admin\AppData\Local\Temp\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1176

\??\c:\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
c:\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Filesize
861KB

MD5
2711faf13bce14d0139a9f1669c27da3

SHA1
7838088fb05b29e54869d7bc50c10f8536da6cb1

SHA256
d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88

SHA512
541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Filesize
861KB

MD5
2711faf13bce14d0139a9f1669c27da3

SHA1
7838088fb05b29e54869d7bc50c10f8536da6cb1

SHA256
d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88

SHA512
541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

Download Submit
\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\??\c:\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\??\c:\1fb9cf2b17d0feadbb592b43b97cc81f\update\update.inf
Filesize
25KB

MD5
ad0328202c8fb53f6c6fc13a4a204801

SHA1
e4b8e689fa23760a1e991777533fef7448b77321

SHA256
06b88504861d7be892f7382af8bc380a8caa2d282d6b12219cee00c561292625

SHA512
0a90cddaf7b05456cde7611b7e4b24f2da97501db8ba015f52593335901722cdd273653c9f4dc42e45b9405c466b55a372498ff5fa038f5fb89603e1df8b8455

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Filesize
861KB

MD5
2711faf13bce14d0139a9f1669c27da3

SHA1
7838088fb05b29e54869d7bc50c10f8536da6cb1

SHA256
d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88

SHA512
541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Filesize
861KB

MD5
2711faf13bce14d0139a9f1669c27da3

SHA1
7838088fb05b29e54869d7bc50c10f8536da6cb1

SHA256
d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88

SHA512
541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e.exe
Filesize
861KB

MD5
2711faf13bce14d0139a9f1669c27da3

SHA1
7838088fb05b29e54869d7bc50c10f8536da6cb1

SHA256
d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88

SHA512
541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

Download Submit
memory/108-66-0x0000000000000000-mapping.dmp

Download
memory/524-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/524-63-0x0000000002740000-0x000000000275E000-memory.dmp

Filesize
120KB

Download
memory/524-62-0x0000000002740000-0x000000000275E000-memory.dmp

Filesize
120KB

Download
memory/524-76-0x0000000002740000-0x000000000275E000-memory.dmp

Filesize
120KB

Download
memory/524-77-0x0000000002740000-0x000000000275E000-memory.dmp

Filesize
120KB

Download
memory/1176-57-0x0000000000000000-mapping.dmp

Download
memory/1176-64-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/1176-75-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads