General
-
Target
34628ca1039a637936735225d91cf6ec1b3042a56fdee1de39ce17775963b211
-
Size
206KB
-
Sample
240619-y8p1dsvcjr
-
MD5
aa08eb4c01a8f694395ad2a5281b0235
-
SHA1
ef8e99ed36a864a9b1d3e91705506a076e7d6274
-
SHA256
34628ca1039a637936735225d91cf6ec1b3042a56fdee1de39ce17775963b211
-
SHA512
d8fc08ff2a9924b72d24d6d515d9797326a84a14adbd6509354659f6c5504a515cd9ee95475d797ed01b28243dd31e4bfd954040932458b78b37ab0ed0ec7579
-
SSDEEP
1536:JxqjQ+P04wsmJCjZdX7Xl0CFChLCZdBFmav82unyYNrbmpcKJOxqjQ+P04wsmJCH:sr85CfXl0CFUeZUOuPHK9r85Cxr85C
Behavioral task
behavioral1
Sample
34628ca1039a637936735225d91cf6ec1b3042a56fdee1de39ce17775963b211.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
34628ca1039a637936735225d91cf6ec1b3042a56fdee1de39ce17775963b211
-
Size
206KB
-
MD5
aa08eb4c01a8f694395ad2a5281b0235
-
SHA1
ef8e99ed36a864a9b1d3e91705506a076e7d6274
-
SHA256
34628ca1039a637936735225d91cf6ec1b3042a56fdee1de39ce17775963b211
-
SHA512
d8fc08ff2a9924b72d24d6d515d9797326a84a14adbd6509354659f6c5504a515cd9ee95475d797ed01b28243dd31e4bfd954040932458b78b37ab0ed0ec7579
-
SSDEEP
1536:JxqjQ+P04wsmJCjZdX7Xl0CFChLCZdBFmav82unyYNrbmpcKJOxqjQ+P04wsmJCH:sr85CfXl0CFUeZUOuPHK9r85Cxr85C
-
Detect Neshta payload
-
Modifies security service
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phorphiex payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1