neshta | 5690987418e7898137bb9f8e706d3ff8f196b1dc612be983012524235f64f6af | Triage

Resubmissions

21-11-2023 21:25

231121-z9p78agf85 10

16-04-2023 14:14

230416-rj2vbsca6z 10

Analysis

max time kernel
108s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2023 14:14

Sharing

Report Analysis Logs

General

Target

QZK RAT Free/Plugins/7zip.dll
Size

1.8MB
MD5

bb4ca828dabc67199159e4d6f7ebfad1
SHA1

3167e23e66ad5b7268f60f445cce382b6300089f
SHA256

2f1d87120286bfc33593a2a62ac3452d4921537005a9d66934a07c0c19a60f71
SHA512

856d329c0ad3e8d7696c473af84e2f4eaa7bf45666d6a16fd7c0137948462e9bc6cb47efec7b0b9666acbfcf6a2e33919fe48419185dbc602cfd98bf10efe3b6
SSDEEP

49152:Mow7W+ocCZY+MjT5OlAYSiqjbxippODgApn1/qvs:YobZY+Mf5OlI/hsi7qv

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
behavioral20/memory/3520-133-0x0000000075200000-0x00000000756E8000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

3520 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3520 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 544 wrote to memory of 3520	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 3520	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 3520	544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QZK RAT Free\Plugins\7zip.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QZK RAT Free\Plugins\7zip.dll",#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-133-0x0000000075200000-0x00000000756E8000-memory.dmp

Filesize
4.9MB

Download