Analysis
- max time kernel
95s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 02:48
Behavioral task
behavioral1
Sample
6859802624a0c85150cff4016dc99090N.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
6859802624a0c85150cff4016dc99090N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
120 seconds
General
- Target 6859802624a0c85150cff4016dc99090N.exe
- Size 236KB
- Sample240715-dagadaxcke
- SHA256 f54281f43575e0ad4e622ad964cee8adaea3b28a386d943b53a486a5cf41d9bb
- MD5 6859802624a0c85150cff4016dc99090
- SHA1 4fdbda98b5927b5ef03d702c3ac9f11457f76e27
- SHA512 ba7064c28343e0f80e69492d2ba73d251f9cdf439eb7b5c3fa980cfb5aad4cb4d0f75bd0d22ceb90eceaa927b3fb11c4bbe58bf0a5d42d821273bba11ecb36ce
- SSDEEP 3072:sr85CmHJT/joq7EGq7RbxXE3tZ/X5cX+J:k9a/rORRE3TP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x000600000002023a-15.dat family_neshta behavioral2/memory/1060-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1060-96-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1060-98-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 6859802624a0c85150cff4016dc99090N.exe - Executes dropped EXE 1 IoCs
pid Process 3172 6859802624a0c85150cff4016dc99090N.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6859802624a0c85150cff4016dc99090N.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 6859802624a0c85150cff4016dc99090N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 6859802624a0c85150cff4016dc99090N.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 6859802624a0c85150cff4016dc99090N.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6859802624a0c85150cff4016dc99090N.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1060 wrote to memory of 3172 1060 6859802624a0c85150cff4016dc99090N.exe 85 PID 1060 wrote to memory of 3172 1060 6859802624a0c85150cff4016dc99090N.exe 85 PID 1060 wrote to memory of 3172 1060 6859802624a0c85150cff4016dc99090N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6859802624a0c85150cff4016dc99090N.exe"C:\Users\Admin\AppData\Local\Temp\6859802624a0c85150cff4016dc99090N.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6859802624a0c85150cff4016dc99090N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\6859802624a0c85150cff4016dc99090N.exe"2⤵
- Executes dropped EXE
PID:3172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\6859802624a0c85150cff4016dc99090N.exe
- Size 196KB
- SHA256 06e218a0a7ad7596f1ed9900814268c0bcc37832c3559c3b0c7bb3e11b91ac47
- MD5 d10e32447f38dfcc85305a935aa2887c
- SHA1 8398e9f128f7be6816809df880a86286fad071a8
- SHA512 3a592395cf25fe51f15c6fb0ba5a0979090494e402c6f84088cbf4fd066d7877c1caa80d40a0cd7a540b5f2e5bcb945eca2be03c4a0bdcf03477dcc8e237f7a1
- SSDEEP 1536:foSmpzVtd8AyIwtBU77V7TDdFv2Moq7EXtsq7RbxCo0p3gmhZqUFt5:cX+cHJT/joq7EGq7RbxXE3tZ/X5
- MD5 SHA1 SHA512 SSDEEP