Overview

overview

10

Static

static

10

72f6b4cf09...de.exe

windows7-x64

10

72f6b4cf09...de.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72f6b4cf094be5b26144340a7fe584d0ef31db89f8247058e848616c98332cde

  • Size

    222KB

  • Sample

    221130-kwzgeahe8w

  • MD5

    46298919d209aa4453b9475080a8c7d4

  • SHA1

    5d5a5c8a3cacc37f2df3f291cf35600bd56f5488

  • SHA256

    72f6b4cf094be5b26144340a7fe584d0ef31db89f8247058e848616c98332cde

  • SHA512

    d6aa6c79fbdc7a35ecbbfdb5eacbacd88733f5fe93e732cfb158ba2299afe48296aef32cfacf9a36ecf8423a493baa2b07b7a400019b0c6e1145a92a9ca3f874

  • SSDEEP

    3072:fDbJ/nCxIV1tKNsz4oVwqqDbJ/nCxIVZr85Cxr85C:ftl1tk8xVRwtl19N9

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      72f6b4cf094be5b26144340a7fe584d0ef31db89f8247058e848616c98332cde

    • Size

      222KB

    • MD5

      46298919d209aa4453b9475080a8c7d4

    • SHA1

      5d5a5c8a3cacc37f2df3f291cf35600bd56f5488

    • SHA256

      72f6b4cf094be5b26144340a7fe584d0ef31db89f8247058e848616c98332cde

    • SHA512

      d6aa6c79fbdc7a35ecbbfdb5eacbacd88733f5fe93e732cfb158ba2299afe48296aef32cfacf9a36ecf8423a493baa2b07b7a400019b0c6e1145a92a9ca3f874

    • SSDEEP

      3072:fDbJ/nCxIV1tKNsz4oVwqqDbJ/nCxIVZr85Cxr85C:ftl1tk8xVRwtl19N9

    Score
    10/10
    neshtapersistencespyware

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks