Resubmissions

09-04-2024 13:12

240409-qfp6pafh29 10

09-04-2024 13:12

240409-qfpj6afh28 10

09-04-2024 13:12

240409-qfnymafh27 10

09-04-2024 13:12

240409-qfnb4afh26 10

08-04-2024 01:29

240408-bwbkxacg64 10

Analysis

  • max time kernel
    596s
  • max time network
    605s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-04-2024 13:12

General

  • Target

    5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe

  • Size

    8.6MB

  • MD5

    0bba9ea4154714cec6d67a8788535723

  • SHA1

    4ae792b89db732e5c664bccaec9ef10797a8488d

  • SHA256

    5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b

  • SHA512

    6cb04eebd19aa8baff8853b5d7474b3f8feb86e0dcc4cc28035c3a44aaada61f6bd9beb7831d6f7e2f742665898994f9aec7264309c0c908e561cca21ee7e2a4

  • SSDEEP

    98304:D6cZV1QNa2cGlKTdAp1VdV/b+tAeGJwTt1BWmJwL+lTBHMjr33:ZZbQ5zdtb6p1BWYHG

Malware Config

Signatures

  • Detect Neshta payload 7 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe
    "C:\Users\Admin\AppData\Local\Temp\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe"
      2⤵
      • Executes dropped EXE
      PID:2816
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3860 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2480
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4364

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

        Filesize

        86KB

        MD5

        3b73078a714bf61d1c19ebc3afc0e454

        SHA1

        9abeabd74613a2f533e2244c9ee6f967188e4e7e

        SHA256

        ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

        SHA512

        75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

      • C:\Users\Admin\AppData\Local\Temp\3582-490\5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b.exe

        Filesize

        8.6MB

        MD5

        dcb04bad2eb62d8e258a8038e741c554

        SHA1

        ba64b4b7134d9ccda5cdd3624cdc898e3778fb7f

        SHA256

        33049016dd8985e97e69d89cad74b59b06488310c0be86d0f83b10ee096b7875

        SHA512

        8f0fb5a453030850c37e6f3b8f94bc0eb04512c4810dfc5499289dc74b1d02c38e639947245e996cfb3398449395d3ba59f1513f5a9c3283dc4d268f0d7265c5

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

        Filesize

        2.6MB

        MD5

        cc74fe855429ddc5afd0492c81a99ed3

        SHA1

        9f01e7f41fe661b9d0ea01b5618d3ca142e0e9c8

        SHA256

        d4244a317932d44c7cdc64bf716a1452c61bfafd28b8ab0fa85fb785725e8dbc

        SHA512

        4a11e0b81b9714e42841ff7744a1baedc8396589cd275ce0627502c5e9582ecdb279602325c01a07616d5d1e4c635ae9aa12353e3273c310e735c480a3f9c442

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

        Filesize

        7.6MB

        MD5

        9ec04a4f8382f1d460edb3abf8061f53

        SHA1

        58bd9778cf4b3ada8f58d07a9c4d70b2633c6abc

        SHA256

        043e8c3a2f8c95a24f96273fa98c5dbc542c6a6c85db94f5874e744f27154891

        SHA512

        42d6f4a4383e51663997b88c77cd08b96bfd3ebcd17d72af0df04748aa23547e5d300eb7e6bfe190746087caea27b80a858e33d349899d8433314eda938f2c0d

      • memory/2108-120-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2108-135-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2108-136-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2108-137-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2108-138-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2108-144-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB