neshta | 8e12be66a20bed006ce45cbf83658bd56441ed070ce3605814d6d8a38b84f462

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-x64-700.exe
Size

4.6MB
MD5

82d05c70559d829137a17d62d637a061
SHA1

4ad6926261e5b6fdd1b3128e005cd5a67e0b5180
SHA256

8e12be66a20bed006ce45cbf83658bd56441ed070ce3605814d6d8a38b84f462
SHA512

25df17152f2b0f84cc2941a83b4ca91e03e98e3e2c6a9531f5b0c95c521f63ece6228fadf14e21a865d3aeaad3b5531c69f5e0ed9a5e5a2e8ef549c2919c974d
SSDEEP

98304:DBrmtk2a4BTBUWaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGu:QxamnqdgyoE+noL54u2wUoylrVml69

Score

10^/10

neshta xred backdoor discovery persistence spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect Neshta payload 38 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016d0e-2.dat	family_neshta
behavioral1/files/0x0001000000010314-13.dat	family_neshta
behavioral1/files/0x0008000000016d21-20.dat	family_neshta
behavioral1/files/0x0008000000016d18-44.dat	family_neshta
behavioral1/files/0x0001000000010312-42.dat	family_neshta
behavioral1/files/0x0001000000010738-41.dat	family_neshta
behavioral1/files/0x001400000000f841-40.dat	family_neshta
behavioral1/files/0x000100000000f7e6-60.dat	family_neshta
behavioral1/files/0x000100000000f7ca-59.dat	family_neshta
behavioral1/files/0x000100000000f776-58.dat	family_neshta
behavioral1/memory/2900-63-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x000100000000f7d8-57.dat	family_neshta
behavioral1/files/0x000100000000f7d3-56.dat	family_neshta
behavioral1/files/0x0001000000010c12-72.dat	family_neshta
behavioral1/memory/1560-96-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/files/0x00010000000108f6-87.dat	family_neshta
behavioral1/files/0x0001000000011b57-85.dat	family_neshta
behavioral1/files/0x0001000000011a18-83.dat	family_neshta
behavioral1/files/0x000200000001180f-116.dat	family_neshta
behavioral1/files/0x0001000000011448-118.dat	family_neshta
behavioral1/files/0x0002000000010c93-120.dat	family_neshta
behavioral1/files/0x0001000000010b0d-117.dat	family_neshta
behavioral1/memory/1704-149-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2156-160-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x0001000000011274-184.dat	family_neshta
behavioral1/files/0x000b000000005986-218.dat	family_neshta
behavioral1/files/0x000d0000000056d3-217.dat	family_neshta
behavioral1/files/0x0004000000005725-216.dat	family_neshta
behavioral1/files/0x000300000000e6f5-215.dat	family_neshta
behavioral1/files/0x0003000000005ab6-214.dat	family_neshta
behavioral1/files/0x00050000000055d8-213.dat	family_neshta
behavioral1/memory/1964-324-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2884-325-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1132-326-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/memory/2884-330-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1964-328-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1132-331-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/memory/1132-363-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 9 IoCs

pid	Process
1560	winrar-x64-700.exe
2884	._cache_winrar-x64-700.exe
2900	svchost.com
2776	_CACHE~1.EXE
1132	Synaptics.exe
1108	Process not Found
1704	._cache_Synaptics.exe
2156	svchost.com
2084	_CACHE~2.EXE

Loads dropped DLL 20 IoCs

pid	Process
1964	winrar-x64-700.exe
1964	winrar-x64-700.exe
1560	winrar-x64-700.exe
1560	winrar-x64-700.exe
1560	winrar-x64-700.exe
2900	svchost.com
1964	winrar-x64-700.exe
2884	._cache_winrar-x64-700.exe
1560	winrar-x64-700.exe
1560	winrar-x64-700.exe
2884	._cache_winrar-x64-700.exe
1132	Synaptics.exe
1132	Synaptics.exe
1132	Synaptics.exe
2156	svchost.com
1108	Process not Found
2884	._cache_winrar-x64-700.exe
1964	winrar-x64-700.exe
1964	winrar-x64-700.exe
2884	._cache_winrar-x64-700.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	winrar-x64-700.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	winrar-x64-700.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	_CACHE~2.EXE
File created	C:\Program Files\WinRAR\Resources.pri	_CACHE~2.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	winrar-x64-700.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	._cache_winrar-x64-700.exe
File created	C:\Program Files\WinRAR\License.txt	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\Zip.SFX	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\WinCon32.SFX	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	winrar-x64-700.exe
File created	C:\Program Files\WinRAR\Descript.ion	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\Uninstall.lst	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\Rar.txt	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	._cache_winrar-x64-700.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259432267	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	._cache_winrar-x64-700.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	winrar-x64-700.exe
File opened for modification	C:\Windows\svchost.com	._cache_winrar-x64-700.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	._cache_Synaptics.exe
File opened for modification	C:\Windows\svchost.com	._cache_Synaptics.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-x64-700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-x64-700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_winrar-x64-700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	_CACHE~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	_CACHE~2.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	winrar-x64-700.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1772	EXCEL.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2776	_CACHE~1.EXE
2776	_CACHE~1.EXE
1772	EXCEL.EXE
2084	_CACHE~2.EXE
2084	_CACHE~2.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1560	1964	winrar-x64-700.exe	30
PID 1964 wrote to memory of 1560	1964	winrar-x64-700.exe	30
PID 1964 wrote to memory of 1560	1964	winrar-x64-700.exe	30
PID 1964 wrote to memory of 1560	1964	winrar-x64-700.exe	30
PID 1560 wrote to memory of 2884	1560	winrar-x64-700.exe	31
PID 1560 wrote to memory of 2884	1560	winrar-x64-700.exe	31
PID 1560 wrote to memory of 2884	1560	winrar-x64-700.exe	31
PID 1560 wrote to memory of 2884	1560	winrar-x64-700.exe	31
PID 2884 wrote to memory of 2900	2884	._cache_winrar-x64-700.exe	32
PID 2884 wrote to memory of 2900	2884	._cache_winrar-x64-700.exe	32
PID 2884 wrote to memory of 2900	2884	._cache_winrar-x64-700.exe	32
PID 2884 wrote to memory of 2900	2884	._cache_winrar-x64-700.exe	32
PID 2900 wrote to memory of 2776	2900	svchost.com	33
PID 2900 wrote to memory of 2776	2900	svchost.com	33
PID 2900 wrote to memory of 2776	2900	svchost.com	33
PID 2900 wrote to memory of 2776	2900	svchost.com	33
PID 1560 wrote to memory of 1132	1560	winrar-x64-700.exe	34
PID 1560 wrote to memory of 1132	1560	winrar-x64-700.exe	34
PID 1560 wrote to memory of 1132	1560	winrar-x64-700.exe	34
PID 1560 wrote to memory of 1132	1560	winrar-x64-700.exe	34
PID 1132 wrote to memory of 1704	1132	Synaptics.exe	35
PID 1132 wrote to memory of 1704	1132	Synaptics.exe	35
PID 1132 wrote to memory of 1704	1132	Synaptics.exe	35
PID 1132 wrote to memory of 1704	1132	Synaptics.exe	35
PID 1704 wrote to memory of 2156	1704	._cache_Synaptics.exe	37
PID 1704 wrote to memory of 2156	1704	._cache_Synaptics.exe	37
PID 1704 wrote to memory of 2156	1704	._cache_Synaptics.exe	37
PID 1704 wrote to memory of 2156	1704	._cache_Synaptics.exe	37
PID 2156 wrote to memory of 2084	2156	svchost.com	38
PID 2156 wrote to memory of 2084	2156	svchost.com	38
PID 2156 wrote to memory of 2084	2156	svchost.com	38
PID 2156 wrote to memory of 2084	2156	svchost.com	38

C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2776
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2084

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE

Filesize
285KB

MD5
831270ac3db358cdbef5535b0b3a44e6

SHA1
c0423685c09bbe465f6bb7f8672c936e768f05a3

SHA256
a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0

SHA512
f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE

Filesize
313KB

MD5
8c4f4eb73490ca2445d8577cf4bb3c81

SHA1
0f7d1914b7aeabdb1f1e4caedd344878f48be075

SHA256
85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

SHA512
65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE

Filesize
569KB

MD5
eef2f834c8d65585af63916d23b07c36

SHA1
8cb85449d2cdb21bd6def735e1833c8408b8a9c6

SHA256
3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

SHA512
2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
381KB

MD5
3ec4922dbca2d07815cf28144193ded9

SHA1
75cda36469743fbc292da2684e76a26473f04a6d

SHA256
0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

SHA512
956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe

Filesize
137KB

MD5
e1833678885f02b5e3cf1b3953456557

SHA1
c197e763500002bc76a8d503933f1f6082a8507a

SHA256
bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14

SHA512
fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE

Filesize
157KB

MD5
a24fbb149eddf7a0fe981bd06a4c5051

SHA1
fce5bb381a0c449efad3d01bbd02c78743c45093

SHA256
5d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d

SHA512
1c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe

Filesize
1.1MB

MD5
034978c5262186b14fd7a2892e30b1cf

SHA1
237397dd3b97c762522542c57c85c3ff96646ba8

SHA256
159776d43dd2a8d843b82ece0faf469f9088a625d474ce4eea9db59d94a844e6

SHA512
d216e757616121d9902b0db2669b6e2aa9eb2697427c9ea2804ebda9690abbf9219c6e603d63ff19dc6115a072985ca862499b5f8319ca057a16e81aec9ea949

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe

Filesize
1.2MB

MD5
467aee41a63b9936ce9c5cbb3fa502cd

SHA1
19403cac6a199f6cd77fc5ac4a6737a9a9782dc8

SHA256
99e5bea5f632ef4af76e4e5108486d5e99386c3d451b983bcd3ad2a49cc04039

SHA512
00c9ccdbbd6fd1be0c2dafd485d811be9bf2076d4efeabc256179befd92679b964e80edcb90ef21f3e874578fdb0003878227f560ca76498865770280f87113e

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

Filesize
125KB

MD5
46e43f94482a27df61e1df44d764826b

SHA1
8b4eab017e85f8103c60932c5efe8dff12dc5429

SHA256
dc6658dec5bf89f65f2d4b9bdb27634bac0bf5354c792bc8970a2b39f535facd

SHA512
ce5bdd3f9a2394ffda83c93fc5604d972f90bd72e6aded357bdf27a2b21a0469f6ac71ce40d9fb4ed8c845468c4171a3c5b4501edbae79447c4f4e08342d4560

Download Submit
C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE

Filesize
246KB

MD5
4f8fc8dc93d8171d0980edc8ad833b12

SHA1
dc2493a4d3a7cb460baed69edec4a89365dc401f

SHA256
1505f3721dd3d7062dadde1633d17e4ee80caf29fd5b6aa6e6a0c481324ffd4e

SHA512
bdc3f83d7428418516daf23a9c2d00571cbaa3755391dfd8c500b6df7f621a67ad8e27775bcdaa20b159cd77d08bcdaf81a0cb7fffdd812978888d43512113a6

Download Submit
C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE

Filesize
188KB

MD5
92ee5c55aca684cd07ed37b62348cd4e

SHA1
6534d1bc8552659f19bcc0faaa273af54a7ae54b

SHA256
bee98e2150e02ad6259184a35e02e75df96291960032b3085535fb0f1f282531

SHA512
fc9f4569a5f3de81d6a490f0fff4765698cdc891933979a3ce661a6291b606630a0c2b15647fc661109fcea466c7a78552b9cfbca6c5b2079ea1632a9f1b6e22

Download Submit
C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE

Filesize
4.1MB

MD5
56f047ff489e52768039ce7017bdc06e

SHA1
3f249d6a9e79c2706ed2e0e12f7e76ebd5e568fc

SHA256
62d6c979d708efe21c9618a18232fd2c74e85bb9560daa298025ab9af784202d

SHA512
a2eae7eae6548d325480560dcca83283a022f00f7d9bd19c0ae801a7acec133a33c5c5eb79432d47c8258d153cadea988217845d58eb4e8aa8070a068befe5e8

Download Submit
C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE

Filesize
1.4MB

MD5
5ae9c0c497949584ffa06f028a6605ab

SHA1
eb24dbd3c8952ee20411691326d650f98d24e992

SHA256
07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e

SHA512
2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
714KB

MD5
3c86c25a76c1413747ae8851bead4bac

SHA1
9342be761a661f51d85fd49fa9b75818aa0c4851

SHA256
b7ff698e4395c9e682027bc710a529139dcc602d97e374fc294bcf5198073493

SHA512
e70376561100d6a4769bc91e4daa3c224ed39f8412391a5ee9b9cae83d08dd2229a25f9099f5336810a757d95b6e81faa30608f35d8761b1c4cc0f41313cb43f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
536KB

MD5
c1d222fe7c6311e0b8d75a8728aa4ce7

SHA1
fe5ec004827c9ac8ddc954fabcfc1e196f49f340

SHA256
ea992e36be623bdafce1062dba476a76dd4b72bcb9173431519227a07b462d18

SHA512
0a209fe566a12274bac9e11937f6aa459f13e73658d6fff63db8fe9b654e9e87aa0406e3454d68ec1897b0465a9c7d9348f45edff434856736bdfa4445e34fa3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
485KB

MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
536KB

MD5
f37059ff5298f91aa09efc2b9e9e0f82

SHA1
20e9046ad7e27cacd549a1cf3f4cee6488f1c9c9

SHA256
8c1e7b048883e735399b83cb87fdde347b22ea1a5fa2b6ca02fb08d6a242d14e

SHA512
72f7b12d5981d9541d91e540ae6d7f9ed3fbfd90a38d97a95adb4c86cf8fe218077d6ce0011be9694ee4bfe8f50ae2d6e754fa82d7de396cd767a417f3a4ac21

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TXdnRQec.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
6b3bfceb3942a9508a2148acbee89007

SHA1
3622ac7466cc40f50515eb6fcdc15d1f34ad3be3

SHA256
e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c

SHA512
fa222bfcade636824af32124b45450c92b1abec7a33e6e647a9248eef5371c127d22ccb7cc5a096b4d5d52e2457f3841293a1b34304e8e5523549856ac02f224

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
3ef1c7215091e71cc869d4bae25bd8e6

SHA1
7aea7c89e8ed7b53ec828de7ba17c45fe510a6be

SHA256
b549fa9002ce39ae7df3f2f027372cadc9d19b10c3f220ba323d2b85d5cbe190

SHA512
7a081a78d43de844f957cdb39ffd69caf9fceb6889cab95e52fae9f5814d0ef6bcfa341d2658545bf9556f2fe9574be41086f272d3d255a77f3bc1e67c102a00

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\MICROS~1\Office14\BCSSync.exe

Filesize
129KB

MD5
b1e0da67a985533914394e6b8ac58205

SHA1
5a65e6076f592f9ea03af582d19d2407351ba6b6

SHA256
67629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f

SHA512
188ebb9a58565ca7ed81a46967a66d583f7dea43a2fc1fe8076a79ef4a83119ccaa22f948a944abae8f64b3a4b219f5184260eff7201eb660c321f6c0d1eba22

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe

Filesize
3.8MB

MD5
e1444ef9fae2c4e96e82fdadb2d55562

SHA1
37e0752741342148132cc052ec94c09c699e4da9

SHA256
ace00d359a579417781ae1b6cb482b8ac2c8acb8617ac0952887fcc43e25b375

SHA512
924394effac8b16650a72422c397d3b827025eb03776fc1d102acc287ad64cab422290871a3e305256e3582e5a778ca33423971c0a407111e48cea5ad2ff54df

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe

Filesize
4.5MB

MD5
a477b22c086fe3b66f2e7c28a7e2f3fc

SHA1
fe8cb3c370d7362039a3a7d18b8f1496dffac027

SHA256
ccac32bfa0d9f9042575c405cc8b09a8c0f5ea551e1eee4a60bedb28146bbf9c

SHA512
1e08025b8e427ab35a1e8cee1c71c67bdb14cf9e54f2cb5149fb026514a4ef7038f824f2a935bc11876b85e1525a9d0406c7ababee141cd32e0db6ffccd2ed43

Download Submit
memory/1132-326-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1132-331-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1132-363-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1560-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1560-96-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1704-149-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1772-137-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1964-324-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-328-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2156-160-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2884-325-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2884-330-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2900-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads