neshta | cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed

General

Target

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
Size

5.9MB
MD5

27ec9720a150d5ecc6abb5611165f8f7
SHA1

17d0dbfe64c6155f269a1a9f5c8a76ac9c226f48
SHA256

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed
SHA512

5c282b0bdf851ea33d057931029fe079018fb9643d50344b9d42fcb7aed88ab4d3875332ff1d3b6ca9c251b220900de257e588b46a1afac79874a97a0e453891
SSDEEP

98304:pdTpYzfK2OBLXpLw3/UU7uBTTZbRDEEnzR08+x:VLw38TVNvzhe

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Executes dropped EXE 1 IoCs

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

pid process

1996 cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

pid	process
1996	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Drops file in Windows directory 1 IoCs

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description ioc process

File opened for modification C:\Windows\svchost.com cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Modifies registry class 1 IoCs

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

description	pid	process	target process
PID 3016 wrote to memory of 1996	3016	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
PID 3016 wrote to memory of 1996	3016	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe	cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe

C:\Users\Admin\AppData\Local\Temp\cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
"C:\Users\Admin\AppData\Local\Temp\cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\3582-490\cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe"
2⤵
- Executes dropped EXE
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Filesize
2.4MB

MD5
d9e8a1fa55faebd36ed2342fedefbedd

SHA1
c25cc7f0035488de9c5df0121a09b5100e1c28e9

SHA256
bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

SHA512
134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\cf97fda03cd0838cbf960b06aa2ae01143314d7e0fadd512ea640d17301583ed.exe
Filesize
5.8MB

MD5
4e7be972ae6115d1b34fc04fdb826845

SHA1
308ab2e1873386f1da735de889fb146e1bdbc111

SHA256
4fc3f9279e809238b122ea68398a276d7f90754e55c3ef0ce692abfaf871e4c5

SHA512
129932bc0810717c79dadcb4501a05247ba11ce79d61e611734389e7d87cd538a1d7d92d3c55cc62471eb2797f1cfa74020a4ba6dc5a8db60eb1f43a3c6a5065

Download Submit
memory/1996-10-0x0000000000400000-0x00000000009D5000-memory.dmp

Filesize
5.8MB

Download
memory/3016-98-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3016-99-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3016-101-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads