Overview

overview

10

Static

static

3

order SL2401-545.exe

windows7-x64

10

order SL2401-545.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9a6b4115e1a143cd4d36fc7a0ef2edd53f18ac454a4576e726b6ce3221b8a46.zip

  • Size

    729KB

  • Sample

    241129-pxqccawkds

  • MD5

    4677b9ea3b8b74425181ca9087733bf0

  • SHA1

    d43fd0adf9dd5382a11d6b7c83da3d6d0ef63002

  • SHA256

    c8b3a6a31e269ce08dc162a54b1e1f6dd20a05bad4af627a50a9a4931830ad8b

  • SHA512

    9ee2a2cf7ea4e7d8cfef083c49d636481561f01a76ed229e3cdecab3c9b70b399aded03df89830e461222169cd164b7f796b4f4b858faa2c3f5f4320aad005a5

  • SSDEEP

    12288:/jVghyAHW6/9Su5h53jX8uRccwVs4Kud7jvQVJUg150QJi/wdWMZn4UlBRJHaOKg:/RgZHNFp3QIwVDd7jvJN4xHalMAA

Score
10/10
neshtadiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target

      order SL2401-545.exe

    • Size

      818KB

    • MD5

      23e6c75cd60aae58526c9bd734324ddf

    • SHA1

      c6a8abd742fe2cd2eeefe2a0ee5d55b28120684c

    • SHA256

      61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e

    • SHA512

      3746d9803a01c5701f944a3197c57f96a56e9b6f4ea2c0da20f5be4a8f4a6e89f86214110baea3762b29c43af8b64331d5c3ebf6583aa949f8ce9db07c27ce31

    • SSDEEP

      24576:Z3tCNVECr4YOprbXj64us/OboCCk8C0CaV2j:Z9CNZyprbXG4ujo5k8C0bVI

    Score
    10/10
    neshtadiscoveryexecutionpersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks