Overview

overview

10

Static

static

1

c73db3a4bf...a7.cmd

windows7-x64

10

c73db3a4bf...a7.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd

  • Size

    6KB

  • Sample

    240524-b42gasgh97

  • MD5

    f96b390af9be44e21ffec109cb107462

  • SHA1

    716dda50fc30581e587c0a3d8c65d45aefbfec14

  • SHA256

    c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7

  • SHA512

    09fdcbc4b6153d37889c4b91f9ce996b5b1131ca50db1f3749420860e2731da915babc6a379e64b762c2cb2f4bf399760dae5b48adffba8ca95ce44b71fdd649

  • SSDEEP

    96:vNL+Uex09u1ayG4ZJSpIOzmJOH2BLE6BNMi9SioPrHu1v7Pn/VKdgoZcLA4sKLUd:vNHbyG4ZJeJzmJYsqju1v7Poqo7zKwd

Score
10/10
neshtaexecutionpersistencespyware

Malware Config

Targets

    • Target

      c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd

    • Size

      6KB

    • MD5

      f96b390af9be44e21ffec109cb107462

    • SHA1

      716dda50fc30581e587c0a3d8c65d45aefbfec14

    • SHA256

      c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7

    • SHA512

      09fdcbc4b6153d37889c4b91f9ce996b5b1131ca50db1f3749420860e2731da915babc6a379e64b762c2cb2f4bf399760dae5b48adffba8ca95ce44b71fdd649

    • SSDEEP

      96:vNL+Uex09u1ayG4ZJSpIOzmJOH2BLE6BNMi9SioPrHu1v7Pn/VKdgoZcLA4sKLUd:vNHbyG4ZJeJzmJYsqju1v7Poqo7zKwd

    Score
    10/10
    neshtaexecutionpersistencespyware

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks