Overview

overview

10

Static

static

3

1545f16d88...1N.exe

windows7-x64

10

1545f16d88...1N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2024 10:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe

  • Size

    2.5MB

  • MD5

    db0334758de1c7e8272e9dfd96e157d0

  • SHA1

    365782b08a80ac7db4e7413da999f50536fe6270

  • SHA256

    1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1

  • SHA512

    48996a1d57cf8548755d02be1cb5bbed4e55acd293e2094df76bf4656ea13e279559c28130714cc2f4eddd57af9d7918fea099155795d86201d1bdad7e83bc6f

  • SSDEEP

    49152:0v7tA+Mr1HPPO3ojj+HSKY8X9tdLmcq/SMYB35CpciI:0DtANrJjKTttdLTM4PF

Score
10/10
neshtabootkitdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe
    "C:\Users\Admin\AppData\Local\Temp\1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Users\Admin\AppData\Local\Temp\3582-490\1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Maps connected drives based on registry
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4120
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x348 0x414
    1⤵
      PID:1392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
      Filesize

      86KB

      MD5

      c324431305861add7ddf9186a9221bd9

      SHA1

      61855e1f81606f3cb336f842a1cdd697c7a40912

      SHA256

      f331213f5bcfed2a6dba0dc0c97b5b309c00b013dc47bdb4726d51cf2c274570

      SHA512

      4b532b2bf6eaf3f618bb08b0a6f7af88ce23d76df146b2d007d5a8224ea0463525a86aacc996468cd3a513404aa66cbc516ed27aa9bd142e46492b160d411dc8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\1545f16d88ce55983a90b16b41ab6ccbadfb90ca4c0d966b3eb6d1d2d57dabf1N.exe
      Filesize

      2.5MB

      MD5

      ab488115268f8bf377e5148c2e91566a

      SHA1

      3d13554918e55bd9d608ac123e39d70d5d060194

      SHA256

      e8383fcde2b780ddf402a5e0b21fbd7d66ac886bf485969f35827336109f2737

      SHA512

      72fe0738d5e10defee2ff4420401f0f80d7dd67d55cb4634b87c6cdc1d11d4e4020c3ca8b8da4440d4d40e8a914bc4fda183f11ed27e0c4cdefec17a41cf3b28

      Download Submit

    • memory/428-175-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/428-173-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/428-172-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/428-171-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/4120-16-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-22-0x000001D3586A0000-0x000001D3587AC000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4120-20-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-26-0x000001D356DF0000-0x000001D356DF6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4120-17-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-15-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-21-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-170-0x00000000007B0000-0x00000000007EC000-memory.dmp

      Filesize

      240KB

      Download

    • memory/4120-169-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-18-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-13-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4120-14-0x00000000007B0000-0x00000000007EC000-memory.dmp

      Filesize

      240KB

      Download

    • memory/4120-11-0x00000000001E0000-0x00000000007EC000-memory.dmp

      Filesize

      6.0MB

      Download