Overview

overview

10

Static

static

10

2023-12-07...ta.exe

windows7-x64

10

2023-12-07...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2023 13:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe

  • Size

    89KB

  • MD5

    c96aaea26eb68728d110271aff839957

  • SHA1

    738890a45ffe8e3f2972628c53eb0d3ef5d51390

  • SHA256

    fdfc6a52ba1cba4c242d0eb70fdcbaf2eb30dce8a39cecf179956457033730a6

  • SHA512

    292c1d579781655ab431eb5de949f69d84a6a73d9c50fa80b6a6b7ca5c7afd8e57e4ba49c12ac4d18d72de40ed5ba213ef62c4024e4bc932421071c9813b319a

  • SSDEEP

    1536:JxqjQ+P04wsmJCJygB2korxag318HxZATvnsblYOwwUB:sr85CJyS2koVp318RZEvsbyOCB

Score
10/10
makopneshtapersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 9 IoCs
  • MAKOP ransomware payload 3 IoCs
  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:472
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe"
      2⤵
      • Executes dropped EXE
      PID:4188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
    Filesize

    2.4MB

    MD5

    8ffc3bdf4a1903d9e28b99d1643fc9c7

    SHA1

    919ba8594db0ae245a8abd80f9f3698826fc6fe5

    SHA256

    8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

    SHA512

    0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe
    Filesize

    49KB

    MD5

    85133a404d3fb4a98da14bdd4f08c148

    SHA1

    b62b4102da9112e3d77b530508424611efd3225e

    SHA256

    4e0ab00838f4f48eae4e1ee2f703bce382eca68e2ceff480379cb5ac90b83273

    SHA512

    dd0d892552983c9f2bc39b91f6e5c863caac8ad6d5ddb71dffa14c5bd7f12fff7418c32e17135fbbd483213d515723a0c74b5db1aeefeb296fa9214b86d374b8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe
    Filesize

    49KB

    MD5

    85133a404d3fb4a98da14bdd4f08c148

    SHA1

    b62b4102da9112e3d77b530508424611efd3225e

    SHA256

    4e0ab00838f4f48eae4e1ee2f703bce382eca68e2ceff480379cb5ac90b83273

    SHA512

    dd0d892552983c9f2bc39b91f6e5c863caac8ad6d5ddb71dffa14c5bd7f12fff7418c32e17135fbbd483213d515723a0c74b5db1aeefeb296fa9214b86d374b8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-12-07_c96aaea26eb68728d110271aff839957_makop_neshta.exe
    Filesize

    49KB

    MD5

    85133a404d3fb4a98da14bdd4f08c148

    SHA1

    b62b4102da9112e3d77b530508424611efd3225e

    SHA256

    4e0ab00838f4f48eae4e1ee2f703bce382eca68e2ceff480379cb5ac90b83273

    SHA512

    dd0d892552983c9f2bc39b91f6e5c863caac8ad6d5ddb71dffa14c5bd7f12fff7418c32e17135fbbd483213d515723a0c74b5db1aeefeb296fa9214b86d374b8

    Download Submit
  • memory/472-95-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-96-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-97-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-98-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-99-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-100-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-101-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/472-103-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download