neshta | 9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
Size

344KB
MD5

2730ab4cf366b53d78a9d172c9b9ef5c
SHA1

554ed8f8cfaf51db2a6fd6dc35dc3e5060bb5ac4
SHA256

9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4
SHA512

c359e054aaa52047cb81207788d72b2d93be22252f01aad260823cdb1c479021c6cf5b1a6ac6d4931286bc69166d1e88b23d51d4de93309836f73af6280d3f1b
SSDEEP

6144:/9Gpcq+HpFeHPgsHsSYafq8g2OLWFTlAOBh:opcqapMvgzS/JuuAQ

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 14 IoCs

resource	yara_rule
behavioral2/memory/2720-0-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/files/0x000600000001ffe8-15.dat	family_neshta
behavioral2/memory/2720-28-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-109-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-110-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-111-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-112-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-113-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-114-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-115-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-116-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-117-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-118-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta
behavioral2/memory/2720-119-0x0000000000400000-0x000000000042D000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\INSTAL~1\setup.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\notification_click_helper.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\pwahelper.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\cookie_exporter.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~2.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2888	2720	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe	99
PID 2720 wrote to memory of 2888	2720	9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe	99

C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
"C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
  2⤵
  - Executes dropped EXE
  PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1380 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
cf26c2bb021e5a55c9efe85c8f71d80a

SHA1
596e16eaa10698c4e75681bd39b49cc566ebe124

SHA256
f2e502c323c8a376721ee70e5309a06dcb3f8bf6df040b9a466fd0f8c5e8600c

SHA512
301f12e40317b5a0159258a87774a38f0027cb868368807187500c6b2e472228deec4356d4125da89b8263a269c42cbee218e505fcd84617457d8aa47ea2a1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

Filesize
304KB

MD5
a2ff144973a98d241d129081fa9baa6b

SHA1
7db942775d84fe782e85390c0ddd1b1ef61617b1

SHA256
1cc8e44c620067448bdd2fa88f9ff3a3c64b9a3f06b51c4116ab73376a48bc0a

SHA512
c71abb7c0ad554d5f1a5e324163763c6ff5476d37145092c69f213973278c7899818a3809a80323184eaedcbd45f9f5a6acd73d776dc617d32ededc89f84a303

Download Submit
memory/2720-111-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-28-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-109-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-110-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-112-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-113-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-114-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-115-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-116-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-117-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-118-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2720-119-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads