Analysis
- max time kernel
93s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/04/2024, 18:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe
- Size 268KB
- Sample240408-w9769abe9w
- SHA256 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b
- MD5 66ffc9072fa023d5f24d79101ed98f1f
- SHA1 d21982c44dc1752d57f487608ea2e81e645d356d
- SHA512 25de3c26658088aefbbdee9d115d9a6a24c3f72af37e48cdf0548dbd9a21a05cd08bf7f77495f56bd0d1973a94efbb17bd4e258ce9f2c922d1246168c45674ed
- SSDEEP 3072:zr8WDrCv6ErZCdNL7lO47bowJpo7uoksdrdYZQ+hGaAT5l0NT7SP4/TNvSZ52hbh:PuTrmNXlHb9Po3dQQoW4T7SUSZSbh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detects executables packed with SmartAssembly 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023200-5.dat INDICATOR_EXE_Packed_SmartAssembly - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Executes dropped EXE 1 IoCs
pid Process 896 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MIA062~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1860 dw20.exe Token: SeBackupPrivilege 1860 dw20.exe Token: SeBackupPrivilege 1860 dw20.exe Token: SeBackupPrivilege 1860 dw20.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1824 wrote to memory of 896 1824 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 86 PID 1824 wrote to memory of 896 1824 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 86 PID 1824 wrote to memory of 896 1824 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 86 PID 896 wrote to memory of 1860 896 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 88 PID 896 wrote to memory of 1860 896 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 88 PID 896 wrote to memory of 1860 896 0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe"C:\Users\Admin\AppData\Local\Temp\0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9283⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
- Size 9.4MB
- SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
- MD5 124147ede15f97b47224628152110ce2
- SHA1 4530fee9b1199777693073414b82420a7c88a042
- SHA512 f4c2825380d1bb9ca889d5c5684f13aa0cacb0d6511f6409ca0972a7191195a0175e00c995407848bf09ea03cff05c7395952bf2ffd2af2015b8939f75a8e627
- SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\0e44f09722908be7dbc462d47e686d00f6a479e7a6e85604db90d5da98f57f7b.exe
- Size 227KB
- SHA256 d872392f221584e9ad25871307efffc2f6ef2ed41070061ecb811915cd433520
- MD5 4c187be13a2b41d5ce8438b0ec0852f5
- SHA1 0dac7ea35b175b9d5f6b892023e7d5d135e4887d
- SHA512 2e53f0870579baad111928544ef583ee0de81331e6c7ea00d0325fb004ae319415cecb8238435eab395dc3f07d4c1335cdffecf6f9a980aadf0d3e5e509dc017
- SSDEEP 3072:YTNvSZ52hbC6ErZCdNL7lO47bowJpo7uoksdrdYZQ+hGaAT5l0NT7SP4:CSZSbsrmNXlHb9Po3dQQoW4T7S
- MD5 SHA1 SHA512 SSDEEP