Analysis

  • max time kernel
    1792s
  • max time network
    1154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-07-2024 08:20

General

  • Target

    NL Brute 2/NLBrute.exe

  • Size

    7.8MB

  • MD5

    baf8cba0953051c7062ac27a9d920a8e

  • SHA1

    e56196210132b7bd5016b6d53650f25db57fe330

  • SHA256

    a5657ce27cb25c81c84c019376b503f41a9bd00ee306e7bff2a027ccdbb84a57

  • SHA512

    0448264051635b6ee63730e4c2319560b1536ede3bf966020cdf44c664955177acd39ecc0622f422db0b5e1fa4e7a351388b68df167740ba3d75e7d2c0aeacf3

  • SSDEEP

    196608:w0p8Y4DFbBJ5dIa82Vou2j09a3XAydVdODHMD16UAsdf6:l8YwFV/dIa8wp2j09qXAyYDHMDYrsdi

Malware Config

Signatures

  • Detect Neshta payload 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NL Brute 2\NLBrute.exe
    "C:\Users\Admin\AppData\Local\Temp\NL Brute 2\NLBrute.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute.exe

    Filesize

    7.8MB

    MD5

    025c1c35c3198e6e3497d5dbf97ae81f

    SHA1

    6d390038003c298c7ab8f2cbe35a50b07e096554

    SHA256

    ffa28db79daca3b93a283ce2a6ff24791956a768cb5fc791c075b638416b51f4

    SHA512

    1d4cf52062b4f1aa9349ee96b234fc51e693ea8231230ec2b35fa896c2c27f47158d6493e26a1881b070b3f86e6c7d9d2ed3f5f161d456eb011551d434e06b50

  • memory/3076-158-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-119-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-15-0x0000000005F90000-0x0000000005F91000-memory.dmp

    Filesize

    4KB

  • memory/3076-14-0x0000000005F30000-0x0000000005F31000-memory.dmp

    Filesize

    4KB

  • memory/3076-13-0x0000000005F80000-0x0000000005F81000-memory.dmp

    Filesize

    4KB

  • memory/3076-17-0x0000000000401000-0x000000000081B000-memory.dmp

    Filesize

    4.1MB

  • memory/3076-12-0x0000000005FA0000-0x0000000005FA2000-memory.dmp

    Filesize

    8KB

  • memory/3076-11-0x0000000005F60000-0x0000000005F61000-memory.dmp

    Filesize

    4KB

  • memory/3076-18-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-19-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-10-0x0000000077D24000-0x0000000077D26000-memory.dmp

    Filesize

    8KB

  • memory/3076-39-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-46-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-65-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-83-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-95-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-98-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-138-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-111-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-180-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-113-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-179-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-115-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-116-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-178-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-118-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-137-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-177-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-122-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-123-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-124-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-125-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-126-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-127-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-128-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-129-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-130-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-131-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-132-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-133-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-134-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-135-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-146-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-16-0x0000000005F70000-0x0000000005F71000-memory.dmp

    Filesize

    4KB

  • memory/3076-110-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-139-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-140-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-141-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-142-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-143-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-144-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-145-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-136-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-147-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-148-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-149-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-150-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-151-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-152-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-153-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-154-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-155-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-156-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-157-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-9-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-159-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-160-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-161-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-162-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-163-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-164-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-165-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-166-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-167-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-168-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-169-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-170-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-171-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-172-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-173-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-174-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-175-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/3076-176-0x0000000000400000-0x0000000001C9F400-memory.dmp

    Filesize

    24.6MB

  • memory/4468-121-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4468-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4468-114-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4468-112-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB