Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-07-2024 09:29

General

  • Target

    Hit Sender/NLBrute Hit Sender-Checker.exe

  • Size

    1.8MB

  • MD5

    663627e9e7d0f30d41dc754cec70c2a9

  • SHA1

    4f6562ee4c4a209e8ccdd894d5955909afc3498e

  • SHA256

    59c8595468186da0d323b5a5fc0304b04412fe11bea16c11bdce5315502a8716

  • SHA512

    b3184e56e9d9a9ae0bef34912c9e927e0dfdd100b7e36862e2a1f98af56bccb58fa23783cd9f42cbb663e70ba26835a24a27cca5e077b2d5e0a46ff1b8f412c3

  • SSDEEP

    24576:0Yh9sKCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfFZDO+:p/C7uRfbQswUZcSByYGv5ujZ7

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hit Sender\NLBrute Hit Sender-Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Hit Sender\NLBrute Hit Sender-Checker.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 1164
        3⤵
        • Program crash
        PID:3156
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 1252
    1⤵
      PID:3692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

      Filesize

      86KB

      MD5

      3b73078a714bf61d1c19ebc3afc0e454

      SHA1

      9abeabd74613a2f533e2244c9ee6f967188e4e7e

      SHA256

      ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

      SHA512

      75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

    • C:\Users\Admin\AppData\Local\Temp\3582-490\NLBrute Hit Sender-Checker.exe

      Filesize

      1.7MB

      MD5

      43e6a8477f860a82dd1dbd8606e15d76

      SHA1

      f0f1ab3a7907191816c8781b4065034e991201dc

      SHA256

      e2bad47239cd4180d0a1b98f404791fceaf9b1192273ccef07708ff80606574e

      SHA512

      77dfcaccee0d716eba878a069d1865ee737439d03d499b87ca1466d6889097ad5f33532579151b970ee4ed26c13396ecc3cf1593193910b8b490ace44f5af584

    • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

      Filesize

      742KB

      MD5

      544cd51a596619b78e9b54b70088307d

      SHA1

      4769ddd2dbc1dc44b758964ed0bd231b85880b65

      SHA256

      dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

      SHA512

      f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

    • memory/1252-22-0x0000000005F10000-0x00000000064B4000-memory.dmp

      Filesize

      5.6MB

    • memory/1252-25-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-20-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-21-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-23-0x0000000005A00000-0x0000000005A92000-memory.dmp

      Filesize

      584KB

    • memory/1252-13-0x0000000000840000-0x0000000000A04000-memory.dmp

      Filesize

      1.8MB

    • memory/1252-24-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-19-0x00000000052E0000-0x00000000052F0000-memory.dmp

      Filesize

      64KB

    • memory/1252-26-0x00000000059E0000-0x00000000059EA000-memory.dmp

      Filesize

      40KB

    • memory/1252-27-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-28-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/1252-12-0x0000000073B5E000-0x0000000073B5F000-memory.dmp

      Filesize

      4KB

    • memory/1252-43-0x0000000073B50000-0x0000000074300000-memory.dmp

      Filesize

      7.7MB

    • memory/2596-114-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2596-115-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2596-117-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB