Analysis Overview

score

10^/10

SHA256

732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a

Threat Level: Known bad

The file mtk.exe was found to be: Known bad.

Malicious Activity Summary

neshta strongpity persistence spyware stealer upx

StrongPity Spyware

Detect Neshta payload

Neshta

StrongPity

Winexe tool used by Sofacy APT in several incidents

UPX packed file

Unsigned PE

NSIS installer

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2023-10-24 18:49

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-24 18:49

Reported

2023-10-24 18:51

Platform

win7-20231020-en

Max time kernel

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mtk.exe"

Signatures

Detect Neshta payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Neshta

persistence spyware neshta

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Winexe tool used by Sofacy APT in several incidents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 804 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2860	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2860	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2860	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2656	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2656	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2656	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 524	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 524	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 524	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 816	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 804 wrote to memory of 816	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 804 wrote to memory of 816	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 804 wrote to memory of 1652	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\system32\wermgr.exe
PID 804 wrote to memory of 1652	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\system32\wermgr.exe
PID 804 wrote to memory of 1652	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\system32\wermgr.exe
PID 2812 wrote to memory of 2916	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\wermgr.exe
PID 2812 wrote to memory of 2916	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\wermgr.exe
PID 2812 wrote to memory of 2916	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\wermgr.exe
PID 804 wrote to memory of 1272	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 1272	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 804 wrote to memory of 1272	N/A	C:\Users\Admin\AppData\Local\Temp\mtk.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2256	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2256	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2256	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mtk.exe

"C:\Users\Admin\AppData\Local\Temp\mtk.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -Command "& 'C:\Windows\Temp\369a57d3-f405-4e00-8091-b7f145c69a76.ps1'"