neshta | 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8

Analysis

max time kernel
249s
max time network
392s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Size 140KB
Sample221130-avncmsff3v
SHA256 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8
MD5 24e845e05c8e1d528c6bddd675cbadea
SHA1 9ee56bdf956f3202b684e1ee61df551d74e90b81
SHA512 434d79c6b9deb00c2806b784261431e3431be996001996ca5cc90cdeb6692c2f5e37c93acf9bbc0bdcb5016a86adf997f656743323c8a5d1a0131dec2ee70e9c
SSDEEP 1536:JxqjQ+P04wsmJCvaICi4wVpLwhwcn7HFGb1chsTEWi5twHQ+P04wsmJC:sr85CvaIZ4wDLwhwI7HFGuruHr85C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 1 IoCs

pid	Process
4520	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	4520	WerFault.exe	81

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4520	3584	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe	81
PID 3584 wrote to memory of 4520	3584	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe	81

C:\Users\Admin\AppData\Local\Temp\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
"C:\Users\Admin\AppData\Local\Temp\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe"
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4520 -s 144
    3⤵
    - Program crash
    PID:3296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4520 -ip 4520
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Size 100KB
SHA256 90da85a34d5282e62ce5663d2c65148705d144a0e9b05940a6ea76be8ad8b006
MD5 117edf4d597f1310251c8bbda43b3dfe
SHA1 d9f14bc2c06c262455d05447707ac719e5545f72
SHA512 435ba91098a7e8bc6fdbe57d529bf890248f2f4af26bde09d5097012439c3fb82f94f2f4441f752bf01ca4cfd30c6b5f5cb9bd41c5e175d1443df4e5b1694e20
SSDEEP 1536:ZHQ+P04wsmJCvaICi4wVpLwhwcn7HFGb1chsTEWi5tj:ZHr85CvaIZ4wDLwhwI7HFGurR
MD5 SHA1 SHA512 SSDEEP

Submit Download