Analysis
-
max time kernel
92s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 03:25
General
-
Target
cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f.exe
-
Size
95KB
-
MD5
91f8c5655e265566963c8110f8a9de7b
-
SHA1
b96f17997e415aeb3cdf82a68927aeae232febac
-
SHA256
cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f
-
SHA512
7e9b9612e3b4868afb70c9dd6a94715fd0511043949a89cacead24e2369744525d0a411d92c6cc81f24f7e222e1be37a0ba790dcb9ed7e8ab289e0d4f504f7d1
-
SSDEEP
1536:yxqjQ+P04wsZLnDrC5MXL5uXZnzEPf+hzRsibKplyXTq8OGRnsPFG+RODTbN:zr8WDrCawnYPmROzoTq0+RO7N
Malware Config
Signatures
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 30 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f.exe"C:\Users\Admin\AppData\Local\Temp\cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5d9e8a1fa55faebd36ed2342fedefbedd
SHA1c25cc7f0035488de9c5df0121a09b5100e1c28e9
SHA256bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
SHA512134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33
-
Filesize
471B
MD511d14077869dba67110eb7f6cae1b120
SHA1f05e6bb7204a6e0efff37eedf3447eedc5de7b84
SHA256d59818a872b22bd33909691c19daaf807ac7042fc6897dea5ba296d02530f39e
SHA5129b62bb5f3e777e67ce440ca88f81e5e215443ad2c679b076d10a0534e816853340589d8d8e5e36fc53d60efe4dd5c0537e0fdf011064d1f8ff2c2dbffc2c992d
-
Filesize
404B
MD5420b1127df73c74a848704a2dd660cc0
SHA179434515f39e421eee7de2148b1d5251115fc3c0
SHA2565079d6710d7818ec33d2c4f8f37f07ba5e14f9362e35ccb8b519cbceeb0c87bf
SHA512dd76cd48654deeb1effca87930305385d29e369da45b417c72848a200ec60efe680eb9d7d83d3321626d5cbf2d11b6a3316e6ffab46a978dfef94fd9cb73705e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
60KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
184KB