Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
02/05/2024, 11:41
Behavioral task
behavioral1
Sample
Winrar.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Winrar.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target Winrar.exe
- Size 417KB
- Sample240502-ntkr1sac26
- SHA256 f5c3e496c221d729fd7dc4f98e2d650b0650d251d46430c6186f6933eaee7cbc
- MD5 a5d0fb2ec867a1e64b2e19bdde8ca9d9
- SHA1 d9143273021bbea337e3d9c4cbef4398e0357ff4
- SHA512 a3161d01e70c12c4a69c9616dd6b30cf1ac6eea9e540450f449bac18b9fc5ada9db0bfad54a68d75e18972af5d2ead55d75c2749bd4cf5005a6266c3e4389c6a
- SSDEEP 12288:49UVQGXc35seCsLy+b2rrI3w3cfIiOO6YrPP:kUVrXcJsbstYrI3wsQiOO6YrPP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 3 IoCs
resource yara_rule behavioral2/files/0x000600000002024c-12.dat family_neshta behavioral2/memory/1580-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1580-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Creates new service(s) 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation Winrar.exe - Executes dropped EXE 1 IoCs
pid Process 4128 Winrar.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Winrar.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: Winrar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE Winrar.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE Winrar.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe Winrar.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe Winrar.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Winrar.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Winrar.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe Winrar.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE Winrar.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE Winrar.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe Winrar.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE Winrar.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe Winrar.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe Winrar.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Winrar.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4488 sc.exe 4724 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Winrar.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4128 Winrar.exe 4128 Winrar.exe 4128 Winrar.exe 4128 Winrar.exe 4128 Winrar.exe 4128 Winrar.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1580 wrote to memory of 4128 1580 Winrar.exe 84 PID 1580 wrote to memory of 4128 1580 Winrar.exe 84 PID 1580 wrote to memory of 4128 1580 Winrar.exe 84 PID 4128 wrote to memory of 4724 4128 Winrar.exe 95 PID 4128 wrote to memory of 4724 4128 Winrar.exe 95 PID 4128 wrote to memory of 4724 4128 Winrar.exe 95 PID 4128 wrote to memory of 4488 4128 Winrar.exe 97 PID 4128 wrote to memory of 4488 4128 Winrar.exe 97 PID 4128 wrote to memory of 4488 4128 Winrar.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Winrar.exe"C:\Users\Admin\AppData\Local\Temp\Winrar.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Winrar.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Winrar.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\sc.exe"sc.exe" create emisoft type=kernel binpath=C:\ProgramData\EmiSoft\emi.png3⤵
- Launches sc.exe
PID:4724
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" start emisoft3⤵
- Launches sc.exe
PID:4488
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\Winrar.exe
- Size 377KB
- SHA256 1efbc6fb885bbe976902eee0f6b78f006d98bdf4b84df310776ec3d450b8d82d
- MD5 aeed5a85c33e9ba90c06fec6e5bd14c9
- SHA1 c38fc81907be4cbe5f67d9ec7573e945596dce3d
- SHA512 521560d0c584ee227da2719230edbc49de174ba3c114a4b5cdde7c28693babf14ab0fbe7143cb56637412609e44eab32c35af084b17768eba0cd0e7970b06691
- SSDEEP 6144:eOUz6YrP+HlALRUG9KtVQGXc35sZdWhf8fsu8AIe+bs7rrE9hRTLNta3cfIRT8:eOO6YrPB9UVQGXc35seCsLy+b2rrI3ww
- MD5 SHA1 SHA512 SSDEEP