neshta | de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b

General

Target

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
Size

146KB
MD5

82db083cd3959ca041f0fad9e217db7b
SHA1

4328511f637e3eca85117161b0ca01af2398bfb6
SHA256

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b
SHA512

56d74b364633ca790e685dd2f2a35ce20c065c137985e380e859e4ff2e350c1f461d8b9a39a1eb804a35c0ac152974739f4e8c653fc84ec9737fcf326b8e364d
SSDEEP

3072:fr85CE4qR8vLZksB+0HdqxiER5AhC48S1m2YPrZ:D9NksB+sYUEXAe6QPt

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Executes dropped EXE 1 IoCs

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

pid process

3400 de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

pid	process
3400	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Drops file in Windows directory 1 IoCs

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description ioc process

File opened for modification C:\Windows\svchost.com de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Modifies registry class 1 IoCs

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

description	pid	process	target process
PID 2584 wrote to memory of 3400	2584	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
PID 2584 wrote to memory of 3400	2584	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
PID 2584 wrote to memory of 3400	2584	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe	de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe

C:\Users\Admin\AppData\Local\Temp\de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
"C:\Users\Admin\AppData\Local\Temp\de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584

C:\Users\Admin\AppData\Local\Temp\3582-490\de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe"
2⤵
- Executes dropped EXE
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Filesize
86KB

MD5
69651bee5e104a27baafdf1bc38b8c12

SHA1
18c687594dfc8c9351b6642750cce349d7893040

SHA256
189f7f02ee2d096a4073e9fb4f62c7d68543ae18f6e66f3440d623083770e91b

SHA512
64028c62c03ce161fe5235b6cd4a7eff52a22b7b1c7078e76ff333452229dd29413b27604a87a3a9744587a45cd31b5778ab704e1679af20864b51e83d6f64c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\de9ad57ccda5862f96406945eafa618f25002f68192cb92954149c14b4d3258b.exe
Filesize
105KB

MD5
b191834eb918c5bcaa46e594561c53c9

SHA1
1eab0f1c6c4e6e36c454556022e80677f1a8360e

SHA256
0fa78eea190e3ae9ddb0e6cd85eb5188947ce0ba748fc6d567ade48b1fb3ae27

SHA512
d16bb62290c752866a150e6b52ae9a6478d8901b194a71f5768896e311a6b5750f4d6741501d8d807ee85c09f65ef2468992a384436838b61fac5f955cdad696

Download Submit
memory/2584-98-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2584-99-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2584-101-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads