Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-04-2024 00:57

General

  • Target

    b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe

  • Size

    1.0MB

  • MD5

    8f8356f6d1d7947fb39790285ee1853c

  • SHA1

    3d7a67bb47104c5eadea145f7c9596646e339a86

  • SHA256

    b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63

  • SHA512

    4251362118a60157a0e86f9e29c8703832fd91bcc164717c7556358cef2c062206ddc05cf12d5c791d6832938e35b1a22b7fe7cdb6bf4604a23728e26677b640

  • SSDEEP

    24576:I4394Ezbn4394Ezb/soUrXxmR4394Ezby4394EzbjBvRJu:I4394Evn4394Ev/soCO4394Evy4394E4

Malware Config

Signatures

  • Detect Neshta payload 10 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe
    "C:\Users\Admin\AppData\Local\Temp\b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe"
      2⤵
      • Executes dropped EXE
      PID:3256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b2942c9c06ee671e60c0c8e4fc9ec40bef5ba59e1a6ae5b9932859ac8d1f4a63.exe

    Filesize

    1014KB

    MD5

    f6d65eb2f9967ae0ba332d48e717a0ad

    SHA1

    1cc8a7b5d70aeb0dc2ffe07062e68f33caef9970

    SHA256

    2dd1deb4b8330a32802fecd5ea18360571e5cb3a7292ec664ce52c7442925230

    SHA512

    32d910e7a015305fcc2fa44b0a00b72ecb5a3bb4f6e4ee607e2911c534ef03294c11fa2db49abea6da2217bd204f84af4cd14cad07c5437487f30c07e709bcf8

  • memory/3256-34-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB

  • memory/3256-110-0x0000000073C30000-0x00000000743E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3256-15-0x00000000054E0000-0x0000000005A84000-memory.dmp

    Filesize

    5.6MB

  • memory/3256-16-0x0000000004F30000-0x0000000004FC2000-memory.dmp

    Filesize

    584KB

  • memory/3256-17-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB

  • memory/3256-18-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

    Filesize

    40KB

  • memory/3256-19-0x0000000005170000-0x00000000051C6000-memory.dmp

    Filesize

    344KB

  • memory/3256-13-0x0000000073C30000-0x00000000743E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3256-12-0x0000000000370000-0x0000000000474000-memory.dmp

    Filesize

    1.0MB

  • memory/3256-113-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB

  • memory/3256-111-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB

  • memory/3256-14-0x0000000004DE0000-0x0000000004E7C000-memory.dmp

    Filesize

    624KB

  • memory/4236-109-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-112-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-108-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-114-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-115-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-116-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-118-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4236-120-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB