neshta | 7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Size 204KB
Sample240731-bx71hatfpd
SHA256 7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91
MD5 6e3688e7abad80c91379f44602c19b5f
SHA1 33eee9b31d498f7eee8ab831c69d768bd002bd7e
SHA512 b44a1859f7df71c6fcb92096162de3ca7d947a8bf831caa9ae083a5af53af524540327eb488b0cfbf68ba57e9bcfc03fd5beadc568dbb06e2f81389acbffb0cb
SSDEEP 3072:zr8WDrCP+EZm0jNJmG2F00EfqADbugtWlHn86JM/iN8vLfW:Pu40BJmGa0HiibeH86r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Key value queried	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	BOTKIL~1.EXE

Executes dropped EXE 3 IoCs

pid	Process
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
4408	svchost.com
1864	BOTKIL~1.EXE

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MIF4FD~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MICROS~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MIA062~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MICROS~2.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MID1AD~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MICROS~4.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Temp\EU9877.tmp\MICROS~3.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BOTKIL~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1620	TASKKILL.exe
956	TASKKILL.exe
3888	TASKKILL.exe
1172	TASKKILL.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Key created	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000_Classes\Local Settings	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE
1864	BOTKIL~1.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Token: SeDebugPrivilege	956	TASKKILL.exe
Token: SeDebugPrivilege	1620	TASKKILL.exe
Token: SeDebugPrivilege	1864	BOTKIL~1.EXE
Token: SeDebugPrivilege	1172	TASKKILL.exe
Token: SeDebugPrivilege	3888	TASKKILL.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 5044	2336	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	84
PID 2336 wrote to memory of 5044	2336	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	84
PID 2336 wrote to memory of 5044	2336	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	84
PID 5044 wrote to memory of 1620	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	85
PID 5044 wrote to memory of 1620	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	85
PID 5044 wrote to memory of 1620	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	85
PID 5044 wrote to memory of 956	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	86
PID 5044 wrote to memory of 956	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	86
PID 5044 wrote to memory of 956	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	86
PID 5044 wrote to memory of 4408	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	90
PID 5044 wrote to memory of 4408	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	90
PID 5044 wrote to memory of 4408	5044	7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe	90
PID 4408 wrote to memory of 1864	4408	svchost.com	91
PID 4408 wrote to memory of 1864	4408	svchost.com	91
PID 4408 wrote to memory of 1864	4408	svchost.com	91
PID 1864 wrote to memory of 3888	1864	BOTKIL~1.EXE	92
PID 1864 wrote to memory of 3888	1864	BOTKIL~1.EXE	92
PID 1864 wrote to memory of 3888	1864	BOTKIL~1.EXE	92
PID 1864 wrote to memory of 1172	1864	BOTKIL~1.EXE	93
PID 1864 wrote to memory of 1172	1864	BOTKIL~1.EXE	93
PID 1864 wrote to memory of 1172	1864	BOTKIL~1.EXE	93

C:\Users\Admin\AppData\Local\Temp\7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
"C:\Users\Admin\AppData\Local\Temp\7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\3582-490\7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\BOTKIL~1.EXE"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Users\Admin\AppData\Roaming\BOTKIL~1.EXE
      C:\Users\Admin\AppData\Roaming\BOTKIL~1.EXE
      4⤵
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\SysWOW64\TASKKILL.exe
        
        TASKKILL /F /IM wscript.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
    - - C:\Windows\SysWOW64\TASKKILL.exe
        
        TASKKILL /F /IM cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
MD5 d9e8a1fa55faebd36ed2342fedefbedd
SHA1 c25cc7f0035488de9c5df0121a09b5100e1c28e9
SHA512 134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33
SSDEEP 49152:4TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:4TfiG/nzU90T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\7ec25d04e1d0a9c9482018473509d14dded166514af2b3351fcdc0af8ad56a91.exe
Size 163KB
SHA256 1adf26633c17278c9b930529b164637a8942cbb1f3267afafec63b56de51dd96
MD5 a668cb93c16026b6ee15b96dbd13d64f
SHA1 878b50a51f28a78ab4350d0c8b327c8172301de6
SHA512 e291e45706ccee09d8f5314a871b783a69ac7caa764c8e9d0c4efe2e548aaee76e77fa284e662e19bfce21b6448e7383b772a8a510f1d903a77277b703ba49d0
SSDEEP 3072:z6JM/iN8vLfG+EZm0jNJmG2F00EfqADbugtWlHn:z6A0BJmGa0HiibeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5023.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
Size 8B
SHA256 6fc97030e414940bc1f523e66163a955d72dfe420a528f293aceb6931b91a2c0
MD5 84e52706696f046e49b6c06f034778f4
SHA1 53626edb915d04341f2c69d74087ef7f234e9f90
SHA512 e02b36a2bbbe7ee4c20e6c65b4ae460fe75102e088e385cf2a7b868922e2aa2105ad4b424963c759b2ab40605cb7ec19067fdbdd03d0fea5ad7982c9c358032b
MD5 SHA1 SHA512

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
MD5 2f50aca08ffc461c86e8fb5bbedda142
SHA1 6fc5319d084c6e13f950c24c78a9cadb7793c638
SHA512 785225fe823c5724c7ebbfb17f31ffcfc2b3b852369b4d3e002b54476ad8c0f4a5d6ac29d43886361bc8deda29db9f9ce70b1e4496b08390a8ead50ddac9d46e
SSDEEP 768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJ:yxqjQ+P04wsZLnDrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2336-123-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2336-105-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2336-121-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4408-124-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4408-127-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5044-12-0x0000000073520000-0x0000000073AD1000-memory.dmp

Download

memory/5044-120-0x0000000073520000-0x0000000073AD1000-memory.dmp

Download

memory/5044-11-0x0000000073520000-0x0000000073AD1000-memory.dmp

Download

memory/5044-10-0x0000000073522000-0x0000000073523000-memory.dmp

Download