neshta | ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f

General

Target

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
Size

112KB
MD5

c0eed9eedb087f8bbbc35791c6915d1d
SHA1

1a7ea22e8680282a1e74446605ab008f6904e78e
SHA256

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f
SHA512

b298a56a60984f471d6524e641299574e3f4d269a6783eeba985cbdf50cbdf6ef6e9babea89d1159f7968503bcb6ff23cf8742f995c719e65587e0ad1d8527cf
SSDEEP

1536:JxqjQ+P04wsmJCatNYYYYtz+yY76HatP4s+3LLpJrC5SmqKiJoqzh:sr85CatNYYYYtzJY766tPXkaYh1h

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

pid process

316 ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

pid	process
316	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Loads dropped DLL 3 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

pid	process
900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Drops file in Windows directory 1 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

description ioc process

File opened for modification C:\Windows\svchost.com ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Modifies registry class 1 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

description	pid	process	target process
PID 900 wrote to memory of 316	900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
PID 900 wrote to memory of 316	900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
PID 900 wrote to memory of 316	900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
PID 900 wrote to memory of 316	900	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe	ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe

C:\Users\Admin\AppData\Local\Temp\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
"C:\Users\Admin\AppData\Local\Temp\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\3582-490\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe"
2⤵
- Executes dropped EXE
PID:316

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
Filesize
72KB

MD5
8d0a1c12e6715ba92cc727201a55d6b5

SHA1
23451d2811f3f0e6752a749d10a9d37f012a840d

SHA256
a98b8aff872e2fcc587896fb6cd06ab5e9d6e7e8b4e53291ab8418c43ed92647

SHA512
3aad1abab9b19c951e97c26e891345a60908e5b3e07f93fecb29707ded936382f83653ce417cb92a463ba4987d89b44f6b2dc2e976db4475affee4501c439dba

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
Filesize
72KB

MD5
8d0a1c12e6715ba92cc727201a55d6b5

SHA1
23451d2811f3f0e6752a749d10a9d37f012a840d

SHA256
a98b8aff872e2fcc587896fb6cd06ab5e9d6e7e8b4e53291ab8418c43ed92647

SHA512
3aad1abab9b19c951e97c26e891345a60908e5b3e07f93fecb29707ded936382f83653ce417cb92a463ba4987d89b44f6b2dc2e976db4475affee4501c439dba

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\ab9075103497d634186aa3dadd92930e2cb2c3a9a2cbc55800cdbe7f5f445f3f.exe
Filesize
72KB

MD5
8d0a1c12e6715ba92cc727201a55d6b5

SHA1
23451d2811f3f0e6752a749d10a9d37f012a840d

SHA256
a98b8aff872e2fcc587896fb6cd06ab5e9d6e7e8b4e53291ab8418c43ed92647

SHA512
3aad1abab9b19c951e97c26e891345a60908e5b3e07f93fecb29707ded936382f83653ce417cb92a463ba4987d89b44f6b2dc2e976db4475affee4501c439dba

Download Submit
memory/316-57-0x0000000000000000-mapping.dmp

Download
memory/316-61-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/900-59-0x0000000002170000-0x0000000002183000-memory.dmp

Filesize
76KB

Download
memory/900-60-0x0000000002170000-0x0000000002183000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads