Overview

overview

10

Static

static

3

6812964531.exe

windows10-2004-x64

10

Resubmissions

19-10-2024 11:46

241019-nxh3lawepj 10

19-10-2024 11:42

241019-nvc4kathmg 7

19-10-2024 11:38

241019-nrspvawcnp 10

19-10-2024 11:33

241019-nnzc8atfla 10

19-10-2024 11:27

241019-nkpplswakl 10

19-10-2024 11:23

241019-nhfnxsvhmk 10

19-10-2024 11:11

241019-najevashqf 10

19-10-2024 11:07

241019-m762qssgph 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6812964531.exe

  • Size

    67KB

  • Sample

    241019-nhfnxsvhmk

  • MD5

    7de65122a13ab9d81368ee3dff3cc80a

  • SHA1

    ecbb4db641431d4d672e4b88e8d309419fd32f04

  • SHA256

    a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123

  • SHA512

    b156d77a665c3256ddfd016e46105b6e87db6a4c1ca77e9bb25b221c368f3cc53dddc7159602cfb926ef0cc9bacac57b6bd41e7e28998883c996727d58d29401

  • SSDEEP

    1536:pr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EXyBej:h7PEg3qcv5PvB/EVj

Score
10/10
neshtaumbraldiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      6812964531.exe

    • Size

      67KB

    • MD5

      7de65122a13ab9d81368ee3dff3cc80a

    • SHA1

      ecbb4db641431d4d672e4b88e8d309419fd32f04

    • SHA256

      a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123

    • SHA512

      b156d77a665c3256ddfd016e46105b6e87db6a4c1ca77e9bb25b221c368f3cc53dddc7159602cfb926ef0cc9bacac57b6bd41e7e28998883c996727d58d29401

    • SSDEEP

      1536:pr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EXyBej:h7PEg3qcv5PvB/EVj

    Score
    10/10
    neshtaumbraldiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Detect Umbral payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks