Overview

overview

10

Static

static

3

b75f2d9006...0N.exe

windows7-x64

10

b75f2d9006...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b75f2d90064b571863f50420c6dc80c0N.exe

  • Size

    6.6MB

  • Sample

    240819-z1yg8swbre

  • MD5

    b75f2d90064b571863f50420c6dc80c0

  • SHA1

    30ee08f1ed6b6ab2d07dee1abfc350786927634e

  • SHA256

    331bfca925802764b7caaa6b00282dd5d4945f577ee039d4154eeb2735735d16

  • SHA512

    1a639be17df58c051128fa7ab6703477d157cae510b8df5d4a347dda64692e14fceec0057c02e3fa001c60de8912ba55679727585556f3a0a673cbadc454c7d4

  • SSDEEP

    98304:/eDq2y8CsL5+Wp686Ka46ws9OqNZ80llF4Pdy:2Dq2y/sBrCd9OK8SGk

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      b75f2d90064b571863f50420c6dc80c0N.exe

    • Size

      6.6MB

    • MD5

      b75f2d90064b571863f50420c6dc80c0

    • SHA1

      30ee08f1ed6b6ab2d07dee1abfc350786927634e

    • SHA256

      331bfca925802764b7caaa6b00282dd5d4945f577ee039d4154eeb2735735d16

    • SHA512

      1a639be17df58c051128fa7ab6703477d157cae510b8df5d4a347dda64692e14fceec0057c02e3fa001c60de8912ba55679727585556f3a0a673cbadc454c7d4

    • SSDEEP

      98304:/eDq2y8CsL5+Wp686Ka46ws9OqNZ80llF4Pdy:2Dq2y/sBrCd9OK8SGk

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks