neshta | 9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
Size

344KB
MD5

2730ab4cf366b53d78a9d172c9b9ef5c
SHA1

554ed8f8cfaf51db2a6fd6dc35dc3e5060bb5ac4
SHA256

9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4
SHA512

c359e054aaa52047cb81207788d72b2d93be22252f01aad260823cdb1c479021c6cf5b1a6ac6d4931286bc69166d1e88b23d51d4de93309836f73af6280d3f1b
SSDEEP

6144:/9Gpcq+HpFeHPgsHsSYafq8g2OLWFTlAOBh:opcqapMvgzS/JuuAQ

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 4 IoCs

resource	yara_rule
behavioral1/memory/1580-1-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral1/files/0x000100000001030f-9.dat	family_neshta
behavioral1/memory/1580-82-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral1/memory/1580-84-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 1 IoCs

pid	Process
2812	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Loads dropped DLL 1 IoCs

pid	Process
1580	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
"C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1580
- C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
c45cf2a33e9baf285a62fda59e805e86

SHA1
53f5f36f090e797c53107e74e03e955191d9c1a0

SHA256
192e54d8fb639333feb3bce452e207af7e7ec5fdcd0562f75783d72255a3c3ed

SHA512
0b23362c67edbb2dd500f0c6c0f4c7656afdbd159e5c9f21eb62030f341cc9f804491ed33a20bc80670497c96ecc577f8d2965ebe9499840333bfc1e0a6719ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Filesize
304KB

MD5
a2ff144973a98d241d129081fa9baa6b

SHA1
7db942775d84fe782e85390c0ddd1b1ef61617b1

SHA256
1cc8e44c620067448bdd2fa88f9ff3a3c64b9a3f06b51c4116ab73376a48bc0a

SHA512
c71abb7c0ad554d5f1a5e324163763c6ff5476d37145092c69f213973278c7899818a3809a80323184eaedcbd45f9f5a6acd73d776dc617d32ededc89f84a303

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
memory/1580-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1580-82-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1580-84-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads