Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    30-07-2024 09:29

General

  • Target

    Hit Sender/NLBrute Hit Sender-Checker.exe

  • Size

    1.8MB

  • MD5

    663627e9e7d0f30d41dc754cec70c2a9

  • SHA1

    4f6562ee4c4a209e8ccdd894d5955909afc3498e

  • SHA256

    59c8595468186da0d323b5a5fc0304b04412fe11bea16c11bdce5315502a8716

  • SHA512

    b3184e56e9d9a9ae0bef34912c9e927e0dfdd100b7e36862e2a1f98af56bccb58fa23783cd9f42cbb663e70ba26835a24a27cca5e077b2d5e0a46ff1b8f412c3

  • SSDEEP

    24576:0Yh9sKCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfFZDO+:p/C7uRfbQswUZcSByYGv5ujZ7

Malware Config

Signatures

  • Detect Neshta payload 3 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hit Sender\NLBrute Hit Sender-Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Hit Sender\NLBrute Hit Sender-Checker.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 728
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • \Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe

    Filesize

    1.7MB

    MD5

    43e6a8477f860a82dd1dbd8606e15d76

    SHA1

    f0f1ab3a7907191816c8781b4065034e991201dc

    SHA256

    e2bad47239cd4180d0a1b98f404791fceaf9b1192273ccef07708ff80606574e

    SHA512

    77dfcaccee0d716eba878a069d1865ee737439d03d499b87ca1466d6889097ad5f33532579151b970ee4ed26c13396ecc3cf1593193910b8b490ace44f5af584

  • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

    Filesize

    742KB

    MD5

    544cd51a596619b78e9b54b70088307d

    SHA1

    4769ddd2dbc1dc44b758964ed0bd231b85880b65

    SHA256

    dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

    SHA512

    f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

  • memory/2232-107-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2232-105-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2332-22-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-20-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-19-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-23-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-25-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-24-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-21-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-26-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-27-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2332-18-0x00000000005D0000-0x00000000005E0000-memory.dmp

    Filesize

    64KB

  • memory/2332-13-0x0000000000D50000-0x0000000000F14000-memory.dmp

    Filesize

    1.8MB

  • memory/2332-12-0x000000007476E000-0x000000007476F000-memory.dmp

    Filesize

    4KB

  • memory/2332-108-0x0000000074760000-0x0000000074E4E000-memory.dmp

    Filesize

    6.9MB