Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 03:59

General

  • Target

    d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe

  • Size

    146KB

  • MD5

    e67df494ee804995d4da00cae4f4cb8f

  • SHA1

    60efe903996c0145f3114cd98eb18f051e4bf58a

  • SHA256

    d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6

  • SHA512

    03490b65ec51b6a3e96f888682f7f0542033323e5fc27c7eda3af1bc52687738b50c7412f42861811a55151c76a3f82ca3c8397b494800db417f98473e61b0fb

  • SSDEEP

    3072:sr85CkkbAYn2GgYlBYN2fHYTo+Zht8wDSRUTT:k9xbAMpgY3gT58DRUTT

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe
    "C:\Users\Admin\AppData\Local\Temp\d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\3582-490\d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe"
      2⤵
      • Executes dropped EXE
      PID:764
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
    1⤵
      PID:1576

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
      Filesize

      86KB

      MD5

      3b73078a714bf61d1c19ebc3afc0e454

      SHA1

      9abeabd74613a2f533e2244c9ee6f967188e4e7e

      SHA256

      ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

      SHA512

      75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

    • C:\Users\Admin\AppData\Local\Temp\3582-490\d6f9daf994d960095111673fd126d4e3e42dc9dedc3b7ad0ad112b2aeaf7e3d6.exe
      Filesize

      105KB

      MD5

      e4e0ba4474105042b8dd721cd6e3a447

      SHA1

      11fd9d419ceaa3b807a67854920cbb267143341f

      SHA256

      93579d1eb17f2f65a3935ea2446d8604e962432497c0855e553f425510198ae8

      SHA512

      54ae4be859ae9173c67734fbdb87bf842bd4a0385f93edf5bee297bf1fdd9ed461f37ad59db33139683a6ae6f230c1b754aeadaa2db48f2cb0c1fd0d5defaaff

    • memory/932-106-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/932-107-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/932-109-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB