Overview

overview

10

Static

static

10

2024-04-03...ta.exe

windows7-x64

10

2024-04-03...ta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-03_0cd0a3a91e7a2b49b67171e78ceeb9e3_makop_neshta

  • Size

    89KB

  • Sample

    240403-plpxfadd85

  • MD5

    0cd0a3a91e7a2b49b67171e78ceeb9e3

  • SHA1

    4c43a460b3fa7935ac554c711d3df904f71f18f2

  • SHA256

    65c62c0a8ff9d29318d9d5e42940c2411b5d2dbc4a9123e569820499364ba187

  • SHA512

    fa29d0214e4aeaf4a8dd3e35268f1bd0516deb6c0591650cb059d5492671ba6548e4a58e7cffa2a4be56c631a36ec462210a7c281bae4a9480ec7813b9f8fa31

  • SSDEEP

    1536:JxqjQ+P04wsmJCW2yLbirrxa3318HxZATvnsblYOdlWnF:sr85CWpOC318RZEvsbyOc

Score
10/10
makopneshtapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-04-03_0cd0a3a91e7a2b49b67171e78ceeb9e3_makop_neshta

    • Size

      89KB

    • MD5

      0cd0a3a91e7a2b49b67171e78ceeb9e3

    • SHA1

      4c43a460b3fa7935ac554c711d3df904f71f18f2

    • SHA256

      65c62c0a8ff9d29318d9d5e42940c2411b5d2dbc4a9123e569820499364ba187

    • SHA512

      fa29d0214e4aeaf4a8dd3e35268f1bd0516deb6c0591650cb059d5492671ba6548e4a58e7cffa2a4be56c631a36ec462210a7c281bae4a9480ec7813b9f8fa31

    • SSDEEP

      1536:JxqjQ+P04wsmJCW2yLbirrxa3318HxZATvnsblYOdlWnF:sr85CWpOC318RZEvsbyOc

    Score
    10/10
    makopneshtapersistenceransomwarespywarestealer

    • Detect Neshta payload

    • MAKOP ransomware payload

    • Makop

      Ransomware family discovered by @VK_Intel in early 2020.

      ransomwaremakop

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks