neshta | 9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03

General

Target

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
Size

812KB
MD5

a68ac326894a3d62dfc171d8eb6da09e
SHA1

0868af8f604f4f3a421f4c5d324e7ca2a4d69a29
SHA256

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03
SHA512

1e70876efc3a3122626ef18d8f1da948286066d96956bc8628cc2a373e1552ce71e2992ace68241a6cd5d160edc02d2541d82ee3e4be376ca1c376d1a11eb3c6
SSDEEP

24576:cizlBXw7GFa0rgCWuH1FWV1JboJvjAvjcvjf:FBXlCUh

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

pid process

3144 9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~3.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~4.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~2.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MIA062~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13169~1.31\MICROS~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Drops file in Windows directory 1 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description ioc process

File opened for modification C:\Windows\svchost.com 9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Modifies registry class 1 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

pid	process
3144	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
3144	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

description	pid	process	target process
PID 1548 wrote to memory of 3144	1548	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
PID 1548 wrote to memory of 3144	1548	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
PID 1548 wrote to memory of 3144	1548	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe	9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe

C:\Users\Admin\AppData\Local\Temp\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
"C:\Users\Admin\AppData\Local\Temp\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
Filesize
771KB

MD5
86a8b3d698b231192b72e5de3c8059ff

SHA1
8f220fd2870aa6eea2d653f402150c901cf7a17c

SHA256
d234ab97c05870089bc97e500d0cf768ae69e25d7692e020d61e696733c54e7c

SHA512
5073a31405edab7ee492b84a3f4cf845a844f3e05a28a887dcd96a5a25af31c2741b84496260eb274a3445144c3d4674401180c9c77f68635d739286b63bc1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03.exe
Filesize
771KB

MD5
86a8b3d698b231192b72e5de3c8059ff

SHA1
8f220fd2870aa6eea2d653f402150c901cf7a17c

SHA256
d234ab97c05870089bc97e500d0cf768ae69e25d7692e020d61e696733c54e7c

SHA512
5073a31405edab7ee492b84a3f4cf845a844f3e05a28a887dcd96a5a25af31c2741b84496260eb274a3445144c3d4674401180c9c77f68635d739286b63bc1db

Download Submit
memory/3144-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads