neshta | 7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA of March.exe
Size 728KB
Sample240416-d775csad7x
SHA256 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
MD5 2f8cf1eacce33f87429c022d57a1ebea
SHA1 a9ebe3f2e6de49eda0493cbae362d2b033461243
SHA512 54f9afe991c68b7083db5e4b514bfa693a63e1d4d40f94d0d4e95b0a545252bffb3acb8a38f84621cadfb7aa1126a91d579cddef254a2f4b318450e3f9af8f18
SSDEEP 12288:mtOoZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6g:muJD+XqRuKtsbCxKl3b2qkhWRi/RBOja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 7 IoCs

resource	yara_rule
behavioral1/memory/2436-29-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2436-30-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2436-32-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2436-48-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2724-49-0x0000000002780000-0x00000000027C0000-memory.dmp	family_neshta
behavioral1/memory/2436-125-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2436-127-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Loads dropped DLL 1 IoCs

pid	Process
2436	SOA of March.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SOA of March.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1392 set thread context of 2436	1392	SOA of March.exe	34

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	SOA of March.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	SOA of March.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2680	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SOA of March.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2724	1392	SOA of March.exe	28
PID 1392 wrote to memory of 2724	1392	SOA of March.exe	28
PID 1392 wrote to memory of 2724	1392	SOA of March.exe	28
PID 1392 wrote to memory of 2724	1392	SOA of March.exe	28
PID 1392 wrote to memory of 2532	1392	SOA of March.exe	30
PID 1392 wrote to memory of 2532	1392	SOA of March.exe	30
PID 1392 wrote to memory of 2532	1392	SOA of March.exe	30
PID 1392 wrote to memory of 2532	1392	SOA of March.exe	30
PID 1392 wrote to memory of 2680	1392	SOA of March.exe	32
PID 1392 wrote to memory of 2680	1392	SOA of March.exe	32
PID 1392 wrote to memory of 2680	1392	SOA of March.exe	32
PID 1392 wrote to memory of 2680	1392	SOA of March.exe	32
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34
PID 1392 wrote to memory of 2436	1392	SOA of March.exe	34

C:\Users\Admin\AppData\Local\Temp\SOA of March.exe
"C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fxIsxsw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fxIsxsw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86BD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\SOA of March.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ose.exe

Path C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
Size 186KB
SHA256 5ebc7447d1890caf18b682c8c3305f33e8cc167ae761a0113af4c3cbe42bfa69
MD5 bebc581f9d4d0d3ece634da94ad8ebcd
SHA1 a8cedefcf19ca8bb54e4c399789cd35de1d7dcef
SHA512 6daa8aeaed7be1eeff335de2f3735a586422414d59d193a89fda485b4fef1c9e18efe3c923c54e331c53ee39ac9268a8da5cfe7250721de902d18a257f7f4fdd
SSDEEP 3072:5Xnm47QGOnX5M4Kw6JrokFyF5Zat/Vq09oe4QgNOd3z7:ZfsRnX5J6rokFyENNjOc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp86BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp86BD.tmp
Size 1KB
SHA256 ecf2b3a5cfeb2ac8783b492d341e874fd4c2f2b79070fde6394a41b47ca3bd08
MD5 cf4595f6bb9662693c7a41a444e24884
SHA1 0a164f0f8e1ca4cb7c6d40ac9a8636fea39cbc14
SHA512 a73219861a4673ad490d9988c212ecd06a61a2acaa036f901932de8bfa484b3d4c697217ab2f16ecf85eca4031770dca4d1d08f41d7a59d054f1c0c72026b3e3
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 7d77dcc6dbde192b3535d181fb6db9dd3883d9f13d410c81be5fad5d5c17ac60
MD5 bacc82688141563bb2b6027d574d4e90
SHA1 49301e34d1ed8a5c28abaac4d873735340ace04b
SHA512 4e3c9d90061b86f65ada9ac3fb28036074e9e38a8c6381af4558025c08627f03677f7107fe6fa6e9d63388bbdf1f4b5bc7203954df675491c487c5a1a0891d3d
SSDEEP 96:4RqCoOM8PlnqvsqvJCwoSRqCoOM8PlnqvsEHyqvJCwor3yXblQHRF7VQlXlUVF:wDDlUoODDlAHnor30lgF7VQl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxIsxsw.exe

Path C:\Users\Admin\AppData\Roaming\fxIsxsw.exe
Size 728KB
SHA256 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
MD5 2f8cf1eacce33f87429c022d57a1ebea
SHA1 a9ebe3f2e6de49eda0493cbae362d2b033461243
SHA512 54f9afe991c68b7083db5e4b514bfa693a63e1d4d40f94d0d4e95b0a545252bffb3acb8a38f84621cadfb7aa1126a91d579cddef254a2f4b318450e3f9af8f18
SSDEEP 12288:mtOoZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6g:muJD+XqRuKtsbCxKl3b2qkhWRi/RBOja
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOGTRA~1.EXE

Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Size 252KB
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-3-0x0000000004230000-0x00000000042D8000-memory.dmp

Download

memory/1392-6-0x0000000000300000-0x000000000030C000-memory.dmp

Download

memory/1392-7-0x0000000004FA0000-0x000000000502C000-memory.dmp

Download

memory/1392-5-0x00000000002E0000-0x00000000002E8000-memory.dmp

Download

memory/1392-4-0x0000000000260000-0x0000000000272000-memory.dmp

Download

memory/1392-0-0x0000000000880000-0x000000000093C000-memory.dmp

Download

memory/1392-2-0x00000000047E0000-0x0000000004820000-memory.dmp

Download

memory/1392-1-0x0000000074870000-0x0000000074F5E000-memory.dmp

Download

memory/1392-31-0x0000000074870000-0x0000000074F5E000-memory.dmp

Download

memory/2436-29-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-48-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-26-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2436-24-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-23-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-30-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-32-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-22-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-127-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-125-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-20-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-21-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2436-25-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2532-47-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/2532-45-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download

memory/2532-50-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download

memory/2532-43-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/2532-38-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download

memory/2724-46-0x0000000002780000-0x00000000027C0000-memory.dmp

Download

memory/2724-49-0x0000000002780000-0x00000000027C0000-memory.dmp

Download

memory/2724-51-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download

memory/2724-44-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download

memory/2724-40-0x000000006E340000-0x000000006E8EB000-memory.dmp

Download