Analysis

  • max time kernel
    152s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 01:44

General

  • Target

    aaaa.exe

  • Size

    3.3MB

  • MD5

    b6a18b64ba64922793c6849464a26332

  • SHA1

    883da851ff68f948ab237679e0df43561bab0a18

  • SHA256

    073d21d343ad5ea56b3a94e49a1a4e7c1ecb3c4a3e4aae167cd30d22b794ca6c

  • SHA512

    e8c0204eb07cd66960e3648435570afa63a5e7654d19092d89213e151ef8cddce3d333c8244bf60f3710e26507d333e0bf6b34d8f5aff3f90d237b9df61675d3

  • SSDEEP

    98304:P9qUaXiv7NMhB0qCp1KOU/Yqd0AuU0wA:P9Cy2hBOcgqd0G

Malware Config

Signatures

  • Detect Neshta payload 20 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Obfuscated with Agile.Net obfuscator 5 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaaa.exe
    "C:\Users\Admin\AppData\Local\Temp\aaaa.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Users\Admin\AppData\Local\Temp\GTA 5 Mod Menu v2.10.5.exe
      "C:\Users\Admin\AppData\Local\Temp\GTA 5 Mod Menu v2.10.5.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Users\Admin\AppData\Local\Temp\3582-490\GTA 5 Mod Menu v2.10.5.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\GTA 5 Mod Menu v2.10.5.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      2⤵
        PID:2728
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        2⤵
          PID:2740
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
          2⤵
            PID:2640
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
            2⤵
              PID:2308
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
              2⤵
                PID:3008
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                2⤵
                  PID:2748
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                  2⤵
                    PID:2620
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                    2⤵
                      PID:2492
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                      2⤵
                        PID:2700
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                        2⤵
                          PID:2820

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\3582-490\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        ea84cad2bff8c263e6cf3f8f11b93c73

                        SHA1

                        0628144ecdaa823e6f49e097b53558c8ceb72af8

                        SHA256

                        434d8e2bd4678fb649988a401449319ca31ca62cada789ef76167288bf9ce3eb

                        SHA512

                        4959b923f9445b779bc2fece6507bb735d6fede17bb464a3810c780b9709408cfa1255a93bdaa6fb1ec53bc1d250014e8d8d34d39dac8ea0076b01747e9d0d67

                      • C:\Users\Admin\AppData\Local\Temp\3582-490\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        ea84cad2bff8c263e6cf3f8f11b93c73

                        SHA1

                        0628144ecdaa823e6f49e097b53558c8ceb72af8

                        SHA256

                        434d8e2bd4678fb649988a401449319ca31ca62cada789ef76167288bf9ce3eb

                        SHA512

                        4959b923f9445b779bc2fece6507bb735d6fede17bb464a3810c780b9709408cfa1255a93bdaa6fb1ec53bc1d250014e8d8d34d39dac8ea0076b01747e9d0d67

                      • C:\Users\Admin\AppData\Local\Temp\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        064510a44c3c41ae42b2d3c19cb3075e

                        SHA1

                        e747e3076ea823234f9e2cc186bcd7eda517e3a6

                        SHA256

                        24989d4ff18f32b53dab25b6b24eb2e3028084299c5693cd17d2e27d02d4d639

                        SHA512

                        8dec0fe5050bbc3bf73c611ac4deb6f47bb6dc4d5e1c4e359b764dd687c6744434056b1b26112d4c99e5382e75f28b7d533a53faffe5cefa8fdba7ccd3009885

                      • C:\Users\Admin\AppData\Local\Temp\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        064510a44c3c41ae42b2d3c19cb3075e

                        SHA1

                        e747e3076ea823234f9e2cc186bcd7eda517e3a6

                        SHA256

                        24989d4ff18f32b53dab25b6b24eb2e3028084299c5693cd17d2e27d02d4d639

                        SHA512

                        8dec0fe5050bbc3bf73c611ac4deb6f47bb6dc4d5e1c4e359b764dd687c6744434056b1b26112d4c99e5382e75f28b7d533a53faffe5cefa8fdba7ccd3009885

                      • C:\Users\Admin\AppData\Local\Temp\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        064510a44c3c41ae42b2d3c19cb3075e

                        SHA1

                        e747e3076ea823234f9e2cc186bcd7eda517e3a6

                        SHA256

                        24989d4ff18f32b53dab25b6b24eb2e3028084299c5693cd17d2e27d02d4d639

                        SHA512

                        8dec0fe5050bbc3bf73c611ac4deb6f47bb6dc4d5e1c4e359b764dd687c6744434056b1b26112d4c99e5382e75f28b7d533a53faffe5cefa8fdba7ccd3009885

                      • C:\Users\Admin\AppData\Roaming\IXVJFF~1.EXE

                        Filesize

                        3.3MB

                        MD5

                        b6a18b64ba64922793c6849464a26332

                        SHA1

                        883da851ff68f948ab237679e0df43561bab0a18

                        SHA256

                        073d21d343ad5ea56b3a94e49a1a4e7c1ecb3c4a3e4aae167cd30d22b794ca6c

                        SHA512

                        e8c0204eb07cd66960e3648435570afa63a5e7654d19092d89213e151ef8cddce3d333c8244bf60f3710e26507d333e0bf6b34d8f5aff3f90d237b9df61675d3

                      • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

                        Filesize

                        252KB

                        MD5

                        9e2b9928c89a9d0da1d3e8f4bd96afa7

                        SHA1

                        ec66cda99f44b62470c6930e5afda061579cde35

                        SHA256

                        8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

                        SHA512

                        2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

                      • \Users\Admin\AppData\Local\Temp\3582-490\GTA 5 Mod Menu v2.10.5.exe

                        Filesize

                        3.3MB

                        MD5

                        ea84cad2bff8c263e6cf3f8f11b93c73

                        SHA1

                        0628144ecdaa823e6f49e097b53558c8ceb72af8

                        SHA256

                        434d8e2bd4678fb649988a401449319ca31ca62cada789ef76167288bf9ce3eb

                        SHA512

                        4959b923f9445b779bc2fece6507bb735d6fede17bb464a3810c780b9709408cfa1255a93bdaa6fb1ec53bc1d250014e8d8d34d39dac8ea0076b01747e9d0d67

                      • \Users\Admin\AppData\Roaming\IXVJFF~1.EXE

                        Filesize

                        3.3MB

                        MD5

                        b6a18b64ba64922793c6849464a26332

                        SHA1

                        883da851ff68f948ab237679e0df43561bab0a18

                        SHA256

                        073d21d343ad5ea56b3a94e49a1a4e7c1ecb3c4a3e4aae167cd30d22b794ca6c

                        SHA512

                        e8c0204eb07cd66960e3648435570afa63a5e7654d19092d89213e151ef8cddce3d333c8244bf60f3710e26507d333e0bf6b34d8f5aff3f90d237b9df61675d3

                      • memory/2596-31-0x00000000009D0000-0x0000000000D20000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/2596-34-0x0000000074060000-0x000000007474E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2596-115-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2596-113-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2596-112-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2596-108-0x00000000005E0000-0x00000000005F4000-memory.dmp

                        Filesize

                        80KB

                      • memory/2596-120-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2596-72-0x0000000005590000-0x00000000056D2000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/2596-30-0x0000000074060000-0x000000007474E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2596-63-0x0000000002450000-0x00000000024BE000-memory.dmp

                        Filesize

                        440KB

                      • memory/2596-51-0x0000000000410000-0x0000000000430000-memory.dmp

                        Filesize

                        128KB

                      • memory/2596-62-0x0000000000550000-0x000000000055E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2596-38-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2596-61-0x0000000000930000-0x000000000098A000-memory.dmp

                        Filesize

                        360KB

                      • memory/2596-56-0x0000000004860000-0x00000000048A0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2692-60-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-98-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-124-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-123-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-35-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-33-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-69-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-32-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-77-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-84-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-87-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-50-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-14-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-109-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2692-114-0x0000000000400000-0x000000000042B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2824-23-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2824-4-0x000000001C860000-0x000000001CBAE000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/2824-0-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2824-3-0x000000001BC30000-0x000000001BCB0000-memory.dmp

                        Filesize

                        512KB

                      • memory/2824-2-0x000000001BCB0000-0x000000001C00E000-memory.dmp

                        Filesize

                        3.4MB

                      • memory/2824-6-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2824-1-0x000000013F680000-0x000000013F9DE000-memory.dmp

                        Filesize

                        3.4MB

                      • memory/2824-5-0x00000000007D0000-0x000000000081C000-memory.dmp

                        Filesize

                        304KB