Analysis
- max time kernel
140s - max time network
123s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
09/04/2024, 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3433e00fd7556cda4892002a284c39af.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
3433e00fd7556cda4892002a284c39af.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 3433e00fd7556cda4892002a284c39af.exe
- Size 789KB
- Sample240409-11axlsdg39
- SHA256 15647a914dc6605231058f00867206452439ddcd4fec4a92118c64e8b361e729
- MD5 3433e00fd7556cda4892002a284c39af
- SHA1 8926cb8caf476d3a5bbc1bb20450ec26945bf4bb
- SHA512 0d89c5237e797879354eea9311658d64e27f48e46de02ffd82e51d83523b16f7bc34019c2b6a57f9e21a8d6b20b22abd3e0d7a04d0a87911a2272cf123de3141
- SSDEEP 24576:D6ZjW7/9oYT0uezG/aYFkJR30F6rp84bh:Gh+/9t0uq0GJyFav
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 2 IoCs
pid Process 1932 3433e00fd7556cda4892002a284c39af.exe 2968 3433e00fd7556cda4892002a284c39af.tmp - Loads dropped DLL 3 IoCs
pid Process 2312 3433e00fd7556cda4892002a284c39af.exe 1932 3433e00fd7556cda4892002a284c39af.exe 2312 3433e00fd7556cda4892002a284c39af.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3433e00fd7556cda4892002a284c39af.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 3433e00fd7556cda4892002a284c39af.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 3433e00fd7556cda4892002a284c39af.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 3433e00fd7556cda4892002a284c39af.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3433e00fd7556cda4892002a284c39af.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2968 3433e00fd7556cda4892002a284c39af.tmp - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1932 2312 3433e00fd7556cda4892002a284c39af.exe 28 PID 2312 wrote to memory of 1932 2312 3433e00fd7556cda4892002a284c39af.exe 28 PID 2312 wrote to memory of 1932 2312 3433e00fd7556cda4892002a284c39af.exe 28 PID 2312 wrote to memory of 1932 2312 3433e00fd7556cda4892002a284c39af.exe 28 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29 PID 1932 wrote to memory of 2968 1932 3433e00fd7556cda4892002a284c39af.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3433e00fd7556cda4892002a284c39af.exe"C:\Users\Admin\AppData\Local\Temp\3433e00fd7556cda4892002a284c39af.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3433e00fd7556cda4892002a284c39af.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\3433e00fd7556cda4892002a284c39af.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\is-9NNEK.tmp\3433e00fd7556cda4892002a284c39af.tmp"C:\Users\Admin\AppData\Local\Temp\is-9NNEK.tmp\3433e00fd7556cda4892002a284c39af.tmp" /SL5="$40144,376057,121344,C:\Users\Admin\AppData\Local\Temp\3582-490\3433e00fd7556cda4892002a284c39af.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2968
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
- Size 859KB
- SHA256 acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6
- MD5 754309b7b83050a50768236ee966224f
- SHA1 10ed7efc2e594417ddeb00a42deb8fd9f804ed53
- SHA512 e5aaddf62c08c8fcc1ae3f29df220c5c730a2efa96dd18685ee19f5a9d66c4735bb4416c4828033661990604669ed345415ef2dc096ec75e1ab378dd804b1614
- SSDEEP 24576:+Dq1lx7SqE0xJ2pm8FiWCm3LHgZpJEHp37d:+Dq171dxJ6mAQm3LHkJEJLd
- MD5 SHA1 SHA512 SSDEEP
- Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
- Size 252KB
- SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
- MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
- SHA1 ec66cda99f44b62470c6930e5afda061579cde35
- SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
- SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\3582-490\3433e00fd7556cda4892002a284c39af.exe
- Size 748KB
- SHA256 22e2727f8bfa60e427270221e94e358e5707e260ca27fc1fecb8475dbb0622b7
- MD5 6a2043be9a1479b52819518a1c860e9a
- SHA1 85e62586df6f86c1f263d2378ab61b29e93dcacf
- SHA512 4042e3f68718876f68d3a1b776ef7ff408c515c0e0f9ab41242cf7ebc46f89229f2d307471afdd79e378aedfcd694129e87885e2132f3c286d23711dcaa38b50
- SSDEEP 12288:uaHc64b888888888888W88888888888MoscV7/9GqeMo3YM5obYw33rD+zG/oBiq:F86ZjW7/9oYT0uezG/aYFkJR30F6rp8y
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\is-9NNEK.tmp\3433e00fd7556cda4892002a284c39af.tmp
- Size 1.1MB
- SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
- MD5 34acc2bdb45a9c436181426828c4cb49
- SHA1 5adaa1ac822e6128b8d4b59a54d19901880452ae
- SHA512 134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
- SSDEEP 24576:/nbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtdqxyt:/HeKh4nqzF3PYdSto
- MD5 SHA1 SHA512 SSDEEP