General

  • Target

    b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d

  • Size

    685KB

  • Sample

    221202-r13sysbf2x

  • MD5

    a6b4bc29b658725bededeb0c0ff0c351

  • SHA1

    879f8dbc2f7ec45f4b12c3e6ed1c65e775c93036

  • SHA256

    b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d

  • SHA512

    2c657d7ec6b747f4c22d778b74f788e6898ccdc36086d92e734a12f31b1592233be2c61a2e22c5dcd0b753be530b38bbf1a5488b0db83ea2adaf802d6b29e356

  • SSDEEP

    12288:3odmc22J9eWYo7R/LvqZynM8/kjAk2gQ1wwc3OqitK0bpxjmCAhp:3oMA92o7RDqZEM8/kZQ1i3CkCpxjmz

Malware Config

Targets

    • Target

      b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d

    • Size

      685KB

    • MD5

      a6b4bc29b658725bededeb0c0ff0c351

    • SHA1

      879f8dbc2f7ec45f4b12c3e6ed1c65e775c93036

    • SHA256

      b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d

    • SHA512

      2c657d7ec6b747f4c22d778b74f788e6898ccdc36086d92e734a12f31b1592233be2c61a2e22c5dcd0b753be530b38bbf1a5488b0db83ea2adaf802d6b29e356

    • SSDEEP

      12288:3odmc22J9eWYo7R/LvqZynM8/kjAk2gQ1wwc3OqitK0bpxjmCAhp:3oMA92o7RDqZEM8/kZQ1i3CkCpxjmz

    • Detect Neshta payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks