neshta | e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191

General

Target
e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
Size 40KB
Sample240707-bpf7tasbjf
SHA256 e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191
MD5 13b2b4014df7b0a92b170f5cbfa255c8
SHA1 00c3e8628491bbcd0154909123f98278895fdbda
SHA512 ec6d9f29c541f80550ab60a1873fd357559bf029bdd5a7b7ac1e94347a9d705ad1234a710fc0bd65567ede54dcf6306f5654758ddf454291328ce72110d44cd8
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJwZlN1URk:JxqjQ+P04wsmJC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect Neshta payload 7 IoCs

resource	yara_rule
behavioral2/files/0x00060000000202df-4.dat	family_neshta
behavioral2/memory/1184-85-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1184-86-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1184-87-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1184-88-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1184-89-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1184-91-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

C:\Users\Admin\AppData\Local\Temp\e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe
"C:\Users\Admin\AppData\Local\Temp\e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-85-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1184-86-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1184-87-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1184-88-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1184-89-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1184-91-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads