Overview

overview

10

Static

static

10

0A6172B017F62EAA.exe

windows7-x64

10

0A6172B017F62EAA.exe

windows10-2004-x64

10

2891E1D4BAC70EBA.exe

windows7-x64

10

2891E1D4BAC70EBA.exe

windows10-2004-x64

10

3472CB2D1AB89AAB.exe

windows7-x64

10

3472CB2D1AB89AAB.exe

windows10-2004-x64

10

613788884CE0093F.exe

windows7-x64

10

613788884CE0093F.exe

windows10-2004-x64

10

7189AED8B8AE6568.exe

windows7-x64

10

7189AED8B8AE6568.exe

windows10-2004-x64

10

CC3B1F89FAA517E4.exe

windows7-x64

10

CC3B1F89FAA517E4.exe

windows10-2004-x64

10

F5657AC3DC58DC8C.exe

windows7-x64

10

F5657AC3DC58DC8C.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2024 05:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    F5657AC3DC58DC8C.exe

  • Size

    177KB

  • MD5

    7bec4faccd4b6485d70a5bb46453ed65

  • SHA1

    e001ad39f7269e5fca76154477e7708b8d729a4b

  • SHA256

    787798eea28e8ea672f3cbfe9ec2ca4460098b491031eab0f8c30b7080f5eb00

  • SHA512

    3deaabc3519eeb1eba3953c2054451f2fa6cfe3f297c643cb29b9017a43d5a43d8dafea5107b0dfe412917932ce40857c0f942e791f76ab8afa5bf4c310b8e37

  • SSDEEP

    3072:sr85CDzbFk58x+o+EFz9/t2f65q8hPBJ2bIoKbwLIQ8YzXEMZK1A2W:k9vxk5zOFNtgJmBJCUbwstYrEMw63

Score
10/10
neshtadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\biobio ransmoware.txt

Ransom Note
kasper Ransmoware ATTENTION! At the moment, your system is not protected. We can fix itand restore files. To get started, send a file to decrypt trial. You can trust us after opening the test file. 2.Do not use free programs to unlock. To restore the system write to both : [email protected] and [email protected] Telegram id:@biobiorans Your Decryption ID: F5657AC3DC58DC8C

Signatures

  • Detect Neshta payload 19 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (9067) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\F5657AC3DC58DC8C.exe
    "C:\Users\Admin\AppData\Local\Temp\F5657AC3DC58DC8C.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\3582-490\F5657AC3DC58DC8C.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\F5657AC3DC58DC8C.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c vssadmin.exe delete shadows /all /quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            5⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2784
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c vssadmin.exe delete shadows /all /quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:772
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            5⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2816
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
    Filesize

    859KB

    MD5

    02ee6a3424782531461fb2f10713d3c1

    SHA1

    b581a2c365d93ebb629e8363fd9f69afc673123f

    SHA256

    ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

    SHA512

    6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

    Download Submit

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

    Download Submit

  • C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
    Filesize

    186KB

    MD5

    58b58875a50a0d8b5e7be7d6ac685164

    SHA1

    1e0b89c1b2585c76e758e9141b846ed4477b0662

    SHA256

    2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

    SHA512

    d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

    Download Submit

  • C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
    Filesize

    1.1MB

    MD5

    566ed4f62fdc96f175afedd811fa0370

    SHA1

    d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

    SHA256

    e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

    SHA512

    cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
    Filesize

    285KB

    MD5

    831270ac3db358cdbef5535b0b3a44e6

    SHA1

    c0423685c09bbe465f6bb7f8672c936e768f05a3

    SHA256

    a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0

    SHA512

    f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
    Filesize

    313KB

    MD5

    8c4f4eb73490ca2445d8577cf4bb3c81

    SHA1

    0f7d1914b7aeabdb1f1e4caedd344878f48be075

    SHA256

    85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

    SHA512

    65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
    Filesize

    569KB

    MD5

    eef2f834c8d65585af63916d23b07c36

    SHA1

    8cb85449d2cdb21bd6def735e1833c8408b8a9c6

    SHA256

    3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

    SHA512

    2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
    Filesize

    381KB

    MD5

    3ec4922dbca2d07815cf28144193ded9

    SHA1

    75cda36469743fbc292da2684e76a26473f04a6d

    SHA256

    0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

    SHA512

    956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe
    Filesize

    137KB

    MD5

    e1833678885f02b5e3cf1b3953456557

    SHA1

    c197e763500002bc76a8d503933f1f6082a8507a

    SHA256

    bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14

    SHA512

    fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe
    Filesize

    373KB

    MD5

    2f6f7891de512f6269c8e8276aa3ea3e

    SHA1

    53f648c482e2341b4718a60f9277198711605c80

    SHA256

    d1ee54eb64f31247f182fd62037e64cdb3876e1100bc24883192bf46bab42c86

    SHA512

    c677f4f7bfb2e02cd0babed896be00567aad08304cbff3a85fcc9816b10247fedd026fee769c9bd45277a4f2814eabe6534f0b04ea804d0095a47a1477188dd6

    Download Submit

  • C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF.EMAIL=[[email protected]]ID=[F5657AC3DC58DC8C].biobio
    Filesize

    151B

    MD5

    2c949695a9e983d8d278cfa8f1f0dee1

    SHA1

    5ab91e517d62949abee71f4559c8f147a8eff495

    SHA256

    df3b6aa90ab40c5432e0d879c58cc7b88f05c7255627235dc63a2350f609b964

    SHA512

    c279a285aba42fca25e87df944c27b96945de43996f965136b04a8eb015546cb3613d9a5d226aa32fc51ac80ca92de8b04d6ac23e4ab2cc83210baedf64499c7

    Download Submit

  • C:\ProgramData\biobio ransmoware.txt
    Filesize

    402B

    MD5

    3e08144c681309544d6795b31a9a968c

    SHA1

    926d41074691d13ca0d0c9df3061a7b2b0fc5761

    SHA256

    e68ce3e30f06d6648ac37d753f90e6aa1e150934d63171bbc6fa6ae14d944fe7

    SHA512

    f42e1ce8226a2e7457098f5991cea712806eb5a543eb126981e44be0311904ed483de7c9938fef8a46716e2f207551eaf62cecef9a99e2e84e0a6c0355969353

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    43B

    MD5

    e636a121fd722eb592a523bbe66f6cb0

    SHA1

    2fa150c33de1c4ae310f48cd120f8be5dfbfc596

    SHA256

    b976f9b5432964c150e6132078453c221610b72eadeeda5b1b449dac60d34830

    SHA512

    e72835defe700af546d7aa088248d90519f06f04acd1adc32db2ac5f641161499a48b3f636a6f5c2b764cd3e45dfbb303be67cc9d88b591ce793a69352f9419c

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    Download Submit

  • \PROGRA~2\INTERN~1\ieinstal.exe
    Filesize

    456KB

    MD5

    ed45d1c3fda215374fbcfc161a57aa80

    SHA1

    5bdf55514758af241c305cd2d8204ac6c4545c23

    SHA256

    cdd288b870fd2b90aa9f8d426925f89ee11d9652ab284dc115bb5e3aa24519c2

    SHA512

    f2309d6ae4c052275e304341026ed22716c2ebf6a60f6c0ed4d71a96937d4b91e270c6845374ce3f1954d03bb053c07d67d93aeee3482b4c19db917d34e71452

    Download Submit

  • \Users\Admin\AppData\Local\Temp\3582-490\F5657AC3DC58DC8C.exe
    Filesize

    137KB

    MD5

    4280ea83cdb85a8b0b347caff5b942f8

    SHA1

    057a37245944517cd8646780e26f2c5feb268145

    SHA256

    f8398f4297b8ccfefe5565e65fff65d6d969b35cd2ac4e693b1959896beca3dd

    SHA512

    b34b870ab411bc09449fd41f58e6b4666ef5927fe93a635b1269972a556e0b84c4a0205ea2512927960f4cd95804d31404d39a9bd1768eef6130b68b01847f8a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ose00000.exe
    Filesize

    145KB

    MD5

    9d10f99a6712e28f8acd5641e3a7ea6b

    SHA1

    835e982347db919a681ba12f3891f62152e50f0d

    SHA256

    70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

    SHA512

    2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

    Download Submit

  • memory/1532-3590-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1532-6348-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1532-9787-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1532-10933-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1704-3589-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1704-6107-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1704-7562-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2736-11475-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download