neshta | 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8

Analysis

max time kernel
249s
max time network
392s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Size

140KB
MD5

24e845e05c8e1d528c6bddd675cbadea
SHA1

9ee56bdf956f3202b684e1ee61df551d74e90b81
SHA256

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8
SHA512

434d79c6b9deb00c2806b784261431e3431be996001996ca5cc90cdeb6692c2f5e37c93acf9bbc0bdcb5016a86adf997f656743323c8a5d1a0131dec2ee70e9c
SSDEEP

1536:JxqjQ+P04wsmJCvaICi4wVpLwhwcn7HFGb1chsTEWi5twHQ+P04wsmJC:sr85CvaIZ4wDLwhwI7HFGuruHr85C

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

pid process

4520 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

pid	process
4520	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Drops file in Windows directory 1 IoCs

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description ioc process

File opened for modification C:\Windows\svchost.com 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3296 4520 WerFault.exe 9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

pid	pid_target	process	target process
3296	4520	WerFault.exe	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Modifies registry class 1 IoCs

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

description	pid	process	target process
PID 3584 wrote to memory of 4520	3584	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
PID 3584 wrote to memory of 4520	3584	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe	9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe

C:\Users\Admin\AppData\Local\Temp\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
"C:\Users\Admin\AppData\Local\Temp\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584

C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe"
2⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4520 -s 144
3⤵
- Program crash
PID:3296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4520 -ip 4520
1⤵
PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Filesize
100KB

MD5
117edf4d597f1310251c8bbda43b3dfe

SHA1
d9f14bc2c06c262455d05447707ac719e5545f72

SHA256
90da85a34d5282e62ce5663d2c65148705d144a0e9b05940a6ea76be8ad8b006

SHA512
435ba91098a7e8bc6fdbe57d529bf890248f2f4af26bde09d5097012439c3fb82f94f2f4441f752bf01ca4cfd30c6b5f5cb9bd41c5e175d1443df4e5b1694e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9ae5114818b67e648426145288e178d9190844ad6ae433fb7445af40a1a244e8.exe
Filesize
100KB

MD5
117edf4d597f1310251c8bbda43b3dfe

SHA1
d9f14bc2c06c262455d05447707ac719e5545f72

SHA256
90da85a34d5282e62ce5663d2c65148705d144a0e9b05940a6ea76be8ad8b006

SHA512
435ba91098a7e8bc6fdbe57d529bf890248f2f4af26bde09d5097012439c3fb82f94f2f4441f752bf01ca4cfd30c6b5f5cb9bd41c5e175d1443df4e5b1694e20

Download Submit
memory/4520-132-0x0000000000000000-mapping.dmp

Download