neshta | 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/07/2024, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO supplies 15 7 24.exe
Size 723KB
Sample240717-jbee3atela
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1
SSDEEP 12288:2Wx2PQfZHFS3LapnnbooqxQPtK9gyANqA5i27ylNNXtMjUJe:fwMZHFS3YnnUQU9VANqAs4y9Mjg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta execution persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1172	powershell.exe
2572	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
2588	PO supplies 15 7 24.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	PO supplies 15 7 24.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2588	2220	PO supplies 15 7 24.exe	37

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	PO supplies 15 7 24.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	PO supplies 15 7 24.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	PO supplies 15 7 24.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	PO supplies 15 7 24.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2220	PO supplies 15 7 24.exe
2220	PO supplies 15 7 24.exe
2220	PO supplies 15 7 24.exe
2220	PO supplies 15 7 24.exe
2220	PO supplies 15 7 24.exe
2220	PO supplies 15 7 24.exe
1172	powershell.exe
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	PO supplies 15 7 24.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1172	2220	PO supplies 15 7 24.exe	30
PID 2220 wrote to memory of 1172	2220	PO supplies 15 7 24.exe	30
PID 2220 wrote to memory of 1172	2220	PO supplies 15 7 24.exe	30
PID 2220 wrote to memory of 1172	2220	PO supplies 15 7 24.exe	30
PID 2220 wrote to memory of 2572	2220	PO supplies 15 7 24.exe	32
PID 2220 wrote to memory of 2572	2220	PO supplies 15 7 24.exe	32
PID 2220 wrote to memory of 2572	2220	PO supplies 15 7 24.exe	32
PID 2220 wrote to memory of 2572	2220	PO supplies 15 7 24.exe	32
PID 2220 wrote to memory of 2724	2220	PO supplies 15 7 24.exe	33
PID 2220 wrote to memory of 2724	2220	PO supplies 15 7 24.exe	33
PID 2220 wrote to memory of 2724	2220	PO supplies 15 7 24.exe	33
PID 2220 wrote to memory of 2724	2220	PO supplies 15 7 24.exe	33
PID 2220 wrote to memory of 3048	2220	PO supplies 15 7 24.exe	36
PID 2220 wrote to memory of 3048	2220	PO supplies 15 7 24.exe	36
PID 2220 wrote to memory of 3048	2220	PO supplies 15 7 24.exe	36
PID 2220 wrote to memory of 3048	2220	PO supplies 15 7 24.exe	36
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37
PID 2220 wrote to memory of 2588	2220	PO supplies 15 7 24.exe	37

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QBloUDNxsti.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QBloUDNxsti" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5EF2.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
  "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"
  2⤵
  PID:3048
- C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
  "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5EF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5EF2.tmp
Size 1KB
SHA256 c7338e8e0433f9b3f7b28fe26250a0b133c8bc5e6fc03c6a1ffba5dc7d680e44
MD5 88549359d42b704d5b3f01345f723b23
SHA1 26e7a0e6db865de62ca1c4a1706cdd43cb2a9c83
SHA512 542a4542b1ae6ec82ecee5fa1561da65570699ad0262d5a67b414e9c7801097bbac8ea03489c4a46283ae6d9ae3772d8274a01fb3e894163459f7c4f43688aac
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 2c04eb4ed3d17512787366278a3500a1b0e7a890228c8ab9a6ae0846392433f4
MD5 8e5b177180921e339ed15144da8c1505
SHA1 9d2f84a66db0f55610e6c44d1aa354abcfe7b519
SHA512 5cc45c69d99b0f6ec2b7524240086b924f52e3a995fc7e01f7d134fd7e93ac9394c76f66733f3362c40b9d6b70bc2d3f60589829dfbf44acc4f4ec07ea53ff8c
SSDEEP 96:EJHOCNM8VnqvsqvJCwonJHOCNM8VnqvsEHyqvJCworMYynQHmH7HeXlUVe:UH7JUoJH7JAHnorM9TH7Hex
MD5 SHA1 SHA512 SSDEEP

Submit Download

QBLOUD~1.EXE

Path C:\Users\Admin\AppData\Roaming\QBLOUD~1.EXE
Size 723KB
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1
SSDEEP 12288:2Wx2PQfZHFS3LapnnbooqxQPtK9gyANqA5i27ylNNXtMjUJe:fwMZHFS3YnnUQU9VANqAs4y9Mjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 0be3fe232479bb98c0801b5b5279e6f0527d470cf93236c9cc8109dd8bf6b268
MD5 831ea2d64c8371b5fb5c293902f942dd
SHA1 41bda99a7dcda14fffc5297f77d73deccf7e52f9
SHA512 eb195b26b63bff3102231be5fcef9e700b23af42485719c1b77e30b06efd7cfd2c170a46d756c38d8056f0a9fa12fd25564bf21a700238035f4d066afadc0b0a
SSDEEP 768:Npm4PGZtuf258f8L8GyuOgs2l/ufsT7kMYkov5+uFgKMy677R:NJOZwk8kJufXVZFYyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOGTRA~1.EXE

Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Size 252KB
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2220-36-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2220-1-0x0000000000EE0000-0x0000000000F9C000-memory.dmp

Download

memory/2220-2-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2220-3-0x00000000007E0000-0x00000000007FA000-memory.dmp

Download

memory/2220-4-0x0000000000A50000-0x0000000000A5E000-memory.dmp

Download

memory/2220-5-0x0000000004D60000-0x0000000004DEE000-memory.dmp

Download

memory/2220-0-0x000000007495E000-0x000000007495F000-memory.dmp

Download

memory/2588-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2588-26-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-24-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-22-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-20-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-18-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-28-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-30-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-33-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2588-34-0x0000000000400000-0x000000000041B000-memory.dmp

Download