Analysis
- max time kernel
92s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2024, 17:04
Behavioral task
behavioral1
Sample
8cde3e5031f19555aea0c8fffcc3c4c2.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
8cde3e5031f19555aea0c8fffcc3c4c2.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 8cde3e5031f19555aea0c8fffcc3c4c2.exe
- Size 221KB
- Sample240203-vk8aaaeba7
- SHA256 a95037039a9920384aa6b478ca54c7d839c72b203c5331a7ffbd9e0f9731c3dc
- MD5 8cde3e5031f19555aea0c8fffcc3c4c2
- SHA1 a85f99bf9fd281e85959dd98c6ebfbe0066b4eb5
- SHA512 5a6032ad58db8acf9bed16cb2dff08c8a2788c9bb2b86de1de82632671805133a21eb9306d8f45ce885adb94aedcefbddc5372f8c4538dff4497ddab9c8bb842
- SSDEEP 3072:sr85CdUYGtIZz+8oCRMy6Fa3fpEifN+r4DWSmDrIC2ox5u:k9dGOUnag0WSMrA
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x0006000000020048-18.dat family_neshta behavioral2/memory/2652-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2652-105-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2652-112-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Executes dropped EXE 2 IoCs
pid Process 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 1576 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1912 set thread context of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~3.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~4.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MIA062~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13181~1.5\MICROS~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MI391D~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~2.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 8cde3e5031f19555aea0c8fffcc3c4c2.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4120 1576 WerFault.exe 97 - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1576 8cde3e5031f19555aea0c8fffcc3c4c2.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1912 2652 8cde3e5031f19555aea0c8fffcc3c4c2.exe 86 PID 2652 wrote to memory of 1912 2652 8cde3e5031f19555aea0c8fffcc3c4c2.exe 86 PID 2652 wrote to memory of 1912 2652 8cde3e5031f19555aea0c8fffcc3c4c2.exe 86 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97 PID 1912 wrote to memory of 1576 1912 8cde3e5031f19555aea0c8fffcc3c4c2.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cde3e5031f19555aea0c8fffcc3c4c2.exe"C:\Users\Admin\AppData\Local\Temp\8cde3e5031f19555aea0c8fffcc3c4c2.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\8cde3e5031f19555aea0c8fffcc3c4c2.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\8cde3e5031f19555aea0c8fffcc3c4c2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\8cde3e5031f19555aea0c8fffcc3c4c2.exeC:\Users\Admin\AppData\Local\Temp\3582-490\8cde3e5031f19555aea0c8fffcc3c4c2.exe3⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 124⤵
- Program crash
PID:4120
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1576 -ip 15761⤵PID:1972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
- Size 178KB
- SHA256 33b2b3851507c5b974e6825d0882373366bf8de6ce2d1bc1cd9fdfac3c23cc99
- MD5 d28debb4e3b38613329dc7c7a96e2e42
- SHA1 05f6be2d99de1a0ed3dc3ee67d765075aec94d0f
- SHA512 4cff4c3edf75d0a76f08cd9b750a98b761f935b557dfe08ef9549f90c15e165c53b6b8da85674688b10a1c4236016f5ede306e10a732a5121aa99662ad3b19c5
- SSDEEP 3072:sr85CSwqgdV9wmjmFh1iSCs/boGthnA0s+/IS+BxG1LAd7nbwi0:k91qMvwmQvChGnn1s+Di8v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\8cde3e5031f19555aea0c8fffcc3c4c2.exe
- Size 181KB
- SHA256 95c7ff271eef622e799e62be523d4df8d11a6c97ac662ed2a6850f3b1b3f8220
- MD5 10e934117ae8dfd8f5000ce9f5e436e0
- SHA1 30f2615de217398aeedb892f7b90e0d35ec65844
- SHA512 f5077f10424b3129bffa3e616afb2265b9c3b77f79828811aece8b09615374e0b9dde3c6c8cc890fe130adad313da9651c5779478ad413e047d9020058b7a604
- SSDEEP 3072:oSmDrIC2ox5NUYGtIZz+8oCRMy6Fa3fpEifN+r4DE:oSMr/GOUnag0E
- MD5 SHA1 SHA512 SSDEEP