Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 19:09

General

  • Target

    1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe

  • Size

    896KB

  • MD5

    202b69e64a8fea82db90b2414ae5431a

  • SHA1

    8bef0e70ec1a52dd7662e5ad93e0757284b5b0d0

  • SHA256

    1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926

  • SHA512

    ee290ee57dcc786e1ffc56088aa6236c90ef550fc8756eb1efd0f8a30fd11b0ff717fccae0415e02cafaca9796bc1bcef1beb976df74b6b9c915461b14797879

  • SSDEEP

    24576:VJcRRv42YJv+YkdNY/BTBSSyhGJMx+NtbzDzN3WEzP8INpiKfg:URvGrl13d8Cpix

Malware Config

Signatures

  • Detect Neshta payload 11 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe
    "C:\Users\Admin\AppData\Local\Temp\1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Users\Admin\AppData\Local\Temp\3582-490\1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe"
      2⤵
      • Executes dropped EXE
      PID:780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    2.4MB

    MD5

    8ffc3bdf4a1903d9e28b99d1643fc9c7

    SHA1

    919ba8594db0ae245a8abd80f9f3698826fc6fe5

    SHA256

    8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

    SHA512

    0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

  • C:\Users\Admin\AppData\Local\Temp\3582-490\1a11391b88600023a6482145104f94c0a86e5cd9d7426e942f263234f3b37926.exe

    Filesize

    856KB

    MD5

    d11e97536dfa2778f1c10517cb3bf17b

    SHA1

    11f25093932ee4f8f7d1a4075b4410b522ca179d

    SHA256

    af3ae671ad68dcc2c51b5a2238afc55b73d7bbae3b096872bef35b8ca28de05b

    SHA512

    f035a804c14dc2f6b24063870c3bc137c4980a5e504814c26c05a6777afedd4fb53b74b499aa9f291089f8941ae637c931f25173d5177687d5e95538ecd6ac1b

  • memory/4748-98-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-99-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-100-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-106-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-108-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-109-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-110-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-111-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-112-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4748-113-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB