Analysis

  • max time kernel
    88s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 07:06

General

  • Target

    7996817746b878c92c5fc407a2d25b55.exe

  • Size

    1.3MB

  • MD5

    7996817746b878c92c5fc407a2d25b55

  • SHA1

    b1a2215278e263048f60d8663a1d8a3adea8e1a0

  • SHA256

    2c2f87ce2d5f3f2e55272aa72b32fbdd30ef6886903266ae645ea9b1e08ab5f1

  • SHA512

    f45f0a53aaf27e88ae9e36b5286bb64ddfdcd8724d202c99a26766afb90fc20fff012116ce2d9437d5371f87f8eb903d5b6ab7518103a07e85c9db6316d3813f

  • SSDEEP

    24576:Bv35bLaP4xtPmUGjgdhkhsuxo5KYviBvtFiCGlt/C9Rt4nyDazxbZYTawquegN:x5phmUkgoXxoSBvWCGl8tEyDaZZYehgN

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7996817746b878c92c5fc407a2d25b55.exe
    "C:\Users\Admin\AppData\Local\Temp\7996817746b878c92c5fc407a2d25b55.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\3582-490\7996817746b878c92c5fc407a2d25b55.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\7996817746b878c92c5fc407a2d25b55.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    1.5MB

    MD5

    c2e2a3c34f7c18a025058ce3b3f43574

    SHA1

    4a4859ccce2daa29d481eb7b85f2b6d8a32d08fb

    SHA256

    41c208baf07294fe664551ce66cd19234354e3bd86b9a1a376d037ee9abf8d19

    SHA512

    6d983742ffb3d940290f8227ae259923a415c36c198bda5f4d6a88c3e8d924a350ca66dd766f5670b0f6bd47544586e98db204d33838313a31e2bb0e4b385229

  • C:\Users\Admin\AppData\Local\Temp\3582-490\7996817746b878c92c5fc407a2d25b55.exe

    Filesize

    1.3MB

    MD5

    4d59dbdd3ffed0560fe92ca61a8cbb73

    SHA1

    f367d5b3b6799d40bcd4f7e7c3031b6426ac1f1d

    SHA256

    67dbac13c701bc2efdbf09b389ea85c3bc4a00d3f86854b835757d87766d38a6

    SHA512

    102129ddd51dcc02ab406b93206f70769d30e252acf6e5bcdf1d4343ca3485dad4856bf047d6371080299f3fc694c09f487b1493964f528ad5d90486ae9562b6

  • memory/5008-95-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5008-96-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5008-98-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB