Resubmissions

09-04-2024 13:12

240409-qfp6pafh29 10

09-04-2024 13:12

240409-qfpj6afh28 10

09-04-2024 13:12

240409-qfnymafh27 10

09-04-2024 13:12

240409-qfnb4afh26 10

08-04-2024 01:29

240408-bwbkxacg64 10

Analysis

  • max time kernel
    294s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-04-2024 13:12

General

  • Target

    5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe

  • Size

    8.6MB

  • MD5

    0bba9ea4154714cec6d67a8788535723

  • SHA1

    4ae792b89db732e5c664bccaec9ef10797a8488d

  • SHA256

    5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b

  • SHA512

    6cb04eebd19aa8baff8853b5d7474b3f8feb86e0dcc4cc28035c3a44aaada61f6bd9beb7831d6f7e2f742665898994f9aec7264309c0c908e561cca21ee7e2a4

  • SSDEEP

    98304:D6cZV1QNa2cGlKTdAp1VdV/b+tAeGJwTt1BWmJwL+lTBHMjr33:ZZbQ5zdtb6p1BWYHG

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe
    "C:\Users\Admin\AppData\Local\Temp\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe"
      2⤵
      • Executes dropped EXE
      PID:5004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    2.4MB

    MD5

    8ffc3bdf4a1903d9e28b99d1643fc9c7

    SHA1

    919ba8594db0ae245a8abd80f9f3698826fc6fe5

    SHA256

    8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

    SHA512

    0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

  • C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe

    Filesize

    8.6MB

    MD5

    dcb04bad2eb62d8e258a8038e741c554

    SHA1

    ba64b4b7134d9ccda5cdd3624cdc898e3778fb7f

    SHA256

    33049016dd8985e97e69d89cad74b59b06488310c0be86d0f83b10ee096b7875

    SHA512

    8f0fb5a453030850c37e6f3b8f94bc0eb04512c4810dfc5499289dc74b1d02c38e639947245e996cfb3398449395d3ba59f1513f5a9c3283dc4d268f0d7265c5

  • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

    Filesize

    2.6MB

    MD5

    1e2769f7012387ea5b91b1e7c79ce55d

    SHA1

    88876090487a4e7e93ec3b6b70f78ba1ff3d37e0

    SHA256

    fb95200fe4c6f12b24a66f7febf24099ccb3bc7a8bd64fa4d368001418019306

    SHA512

    14dc40bb0166a01ac73bd53cf3f68dc7aff17e234e724814710b96a87eabbae3ee0edd0f3b8a0cedfd20f78ed5f75c32c56f69022d46869980a25134534bd6bf

  • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

    Filesize

    10.1MB

    MD5

    d00976835a46f4aaa7722b23c84155fa

    SHA1

    f0183c0ab4ff57d2cae2e06068638cc7cc748b9f

    SHA256

    4d04fa362465c99ce720b47d4e70533916b9181af8c6386b6343a48d50bcbd21

    SHA512

    2342c7176135dd4fd2437bdc4f9bd8f60b7da1fc371f81b0977efca3f37cd1e469a514e66290179e3289e7362f54091c1085b8ae53c6f14e065b7de1a218f0aa

  • memory/4848-105-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4848-114-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4848-116-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB