Analysis
- max time kernel
105s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2024, 16:28
Behavioral task
behavioral1
Sample
e1a072ea7118ea380637c7cd31a9b440N.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
e1a072ea7118ea380637c7cd31a9b440N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
120 seconds
General
- Target e1a072ea7118ea380637c7cd31a9b440N.exe
- Size 346KB
- Sample240725-tythls1elk
- SHA256 05fc7096e891bc3b34679c39aedd84dad708002fc0ea0fafe814edf29c5fc488
- MD5 e1a072ea7118ea380637c7cd31a9b440
- SHA1 f77a8f501d7ae5245e541a87789dcd164dc3f6d6
- SHA512 466abbfd712c0d1cddb873e8360a3a8d092a37a6dec6bd7e7e1aa0104c5880a69bbd9e2076ad45c5eadfecb2c0993a6b9bd9887cea469a877356cd90244205b4
- SSDEEP 6144:k91zVJELlJoquvLPNu/vPfMWMEFfkcDWxI0TCYwAw9g:wVylJoquvLPN43nkcieTYwAw9g
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 5 IoCs
resource yara_rule behavioral2/files/0x000600000002023a-15.dat family_neshta behavioral2/memory/3344-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3344-96-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3344-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3344-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation e1a072ea7118ea380637c7cd31a9b440N.exe - Executes dropped EXE 1 IoCs
pid Process 972 e1a072ea7118ea380637c7cd31a9b440N.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" e1a072ea7118ea380637c7cd31a9b440N.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe e1a072ea7118ea380637c7cd31a9b440N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE e1a072ea7118ea380637c7cd31a9b440N.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com e1a072ea7118ea380637c7cd31a9b440N.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1a072ea7118ea380637c7cd31a9b440N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1a072ea7118ea380637c7cd31a9b440N.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" e1a072ea7118ea380637c7cd31a9b440N.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3344 wrote to memory of 972 3344 e1a072ea7118ea380637c7cd31a9b440N.exe 84 PID 3344 wrote to memory of 972 3344 e1a072ea7118ea380637c7cd31a9b440N.exe 84 PID 3344 wrote to memory of 972 3344 e1a072ea7118ea380637c7cd31a9b440N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1a072ea7118ea380637c7cd31a9b440N.exe"C:\Users\Admin\AppData\Local\Temp\e1a072ea7118ea380637c7cd31a9b440N.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\e1a072ea7118ea380637c7cd31a9b440N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\e1a072ea7118ea380637c7cd31a9b440N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\e1a072ea7118ea380637c7cd31a9b440N.exe
- Size 306KB
- SHA256 f2f092a9d1d44657fe0d3878b8582e1155de4e11427cefda7f6bdbd5c2300f7a
- MD5 25b2ab5a11e0a380901d98c0928282d1
- SHA1 ea13a0d6b3594b713e06c60b20a62e57c9bb0426
- SHA512 d56eb0c8878693d6656485ee05040bed44ddd7272acaf7857c08aced8250e7019f313ad7b4412c6c22789e898cdf8b99a8418430d274fa3f05c7a80ec24c5958
- SSDEEP 6144:QLCYwAw9SzVJELlJoquvLPNu/vPfMWMEFfkcDWxI0E:Q+YwAw9yVylJoquvLPN43nkcieB
- MD5 SHA1 SHA512 SSDEEP