neshta | 640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337

Analysis

max time kernel
146s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Size

416KB
MD5

6f8b7cfea6d31b43eb0693fe22439dd9
SHA1

beb9f2ed72864411a7d51574abb15db301cee9ff
SHA256

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337
SHA512

75992a4414134cb4b7a58959c0dd3b31589de91fa8a671860aa3dc283e9e66f74e4407771b45bdb8b7ad60a440d20b646c453745c85a9626f8960cbaddf0aa70
SSDEEP

6144:c9ZiTc3NWfJRaEfcPjpinjk2J6gaPs247BrNO4A+r94/q6m:vTc01fcPon5J15H04DgqH

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exeupdate.exe

pid process

1800 640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
468 update.exe

pid	process
1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
468	update.exe

Loads dropped DLL 8 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exeupdate.exe

pid	process
1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
468	update.exe
468	update.exe
468	update.exe
1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

description	ioc	process
File opened (read-only)	\??\r:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\s:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\f:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\g:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\q:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\a:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\p:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\v:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\y:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\e:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\j:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\m:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\k:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\l:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\n:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\o:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\t:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\b:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\h:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\i:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\z:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\u:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\w:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened (read-only)	\??\x:	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

Drops file in Program Files directory 64 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

Drops file in Windows directory 2 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exeupdate.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
File opened for modification	C:\Windows\Q810019.log	update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

update.exe

description	pid	process
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeBackupPrivilege	468	update.exe
Token: SeRestorePrivilege	468	update.exe
Token: SeShutdownPrivilege	468	update.exe
Token: SeSecurityPrivilege	468	update.exe
Token: SeTakeOwnershipPrivilege	468	update.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe

description	pid	process	target process
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1200 wrote to memory of 1800	1200	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe
PID 1800 wrote to memory of 468	1800	640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe	update.exe

C:\Users\Admin\AppData\Local\Temp\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
"C:\Users\Admin\AppData\Local\Temp\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1800

\??\c:\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
c:\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:468

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Filesize
376KB

MD5
440c9e942534e1f767d9d29ccd6f0ac2

SHA1
e9376838a72a9272b0b5ffae6e9fbb629f9bc5af

SHA256
5d9e014ed16b78ef7ac4e62e97c416da76192a60d2481f77d07379a16de12d6f

SHA512
f94c953794748973a53d20563897795857e2a0d111e5024c8519d05c774bf31c985e4ceca080394589cc983aae639ef02942a0eb48061a5d5032864ae304f817

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Filesize
376KB

MD5
440c9e942534e1f767d9d29ccd6f0ac2

SHA1
e9376838a72a9272b0b5ffae6e9fbb629f9bc5af

SHA256
5d9e014ed16b78ef7ac4e62e97c416da76192a60d2481f77d07379a16de12d6f

SHA512
f94c953794748973a53d20563897795857e2a0d111e5024c8519d05c774bf31c985e4ceca080394589cc983aae639ef02942a0eb48061a5d5032864ae304f817

Download Submit
C:\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\??\c:\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\??\c:\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.inf
Filesize
3KB

MD5
6681907a740d915dd64898d0aa0be2f3

SHA1
1a31c1914fd0b65de1e3932ba772f4c273d0b0c2

SHA256
d5ac1c11a0270895fb7838ed628aa927afe0f9419531b8dc9f60446edf912b44

SHA512
b8148d772338ba276ed6ed7b7a03ecd1ae73d74afc281d8f7728cc8c32e1d826b6651316d6ea769d786dbaa4896b9a7a2892b93fe7db6e876bc4861f18c6f8d5

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Filesize
376KB

MD5
440c9e942534e1f767d9d29ccd6f0ac2

SHA1
e9376838a72a9272b0b5ffae6e9fbb629f9bc5af

SHA256
5d9e014ed16b78ef7ac4e62e97c416da76192a60d2481f77d07379a16de12d6f

SHA512
f94c953794748973a53d20563897795857e2a0d111e5024c8519d05c774bf31c985e4ceca080394589cc983aae639ef02942a0eb48061a5d5032864ae304f817

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Filesize
376KB

MD5
440c9e942534e1f767d9d29ccd6f0ac2

SHA1
e9376838a72a9272b0b5ffae6e9fbb629f9bc5af

SHA256
5d9e014ed16b78ef7ac4e62e97c416da76192a60d2481f77d07379a16de12d6f

SHA512
f94c953794748973a53d20563897795857e2a0d111e5024c8519d05c774bf31c985e4ceca080394589cc983aae639ef02942a0eb48061a5d5032864ae304f817

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\640c7be1a761f5ac49f17f81fc7a1a8ee8a22bdba59ee23597ce4259e9cdb337.exe
Filesize
376KB

MD5
440c9e942534e1f767d9d29ccd6f0ac2

SHA1
e9376838a72a9272b0b5ffae6e9fbb629f9bc5af

SHA256
5d9e014ed16b78ef7ac4e62e97c416da76192a60d2481f77d07379a16de12d6f

SHA512
f94c953794748973a53d20563897795857e2a0d111e5024c8519d05c774bf31c985e4ceca080394589cc983aae639ef02942a0eb48061a5d5032864ae304f817

Download Submit
\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
\fea4fa3737926f6fb0d57e3fec1b7e90\update\update.exe
Filesize
399KB

MD5
1ef493cfe59a498a5cbf1cb489f07726

SHA1
7e4b7fbab01247cdac2936586148b902bf190347

SHA256
357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3

SHA512
d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

Download Submit
memory/468-63-0x0000000000000000-mapping.dmp

Download
memory/1200-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1200-71-0x00000000025F0000-0x000000000260E000-memory.dmp

Filesize
120KB

Download
memory/1800-72-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/1800-73-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/1800-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads