Overview

overview

10

Static

static

10

Utilman.exe

windows7-x64

10

Utilman.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Utilman.exe

  • Size

    709KB

  • Sample

    241203-y8j45sxrgr

  • MD5

    83aba31021b2d4613af088f11f784301

  • SHA1

    906a0876fc94ad2e4ea10b3d6d61ca6788f1922d

  • SHA256

    de8f674e914b11d418860730c0297cd0a0ea44aa3d2bd58053d2c9a5b259a987

  • SHA512

    16cd85c45a035425ae9428ec657c60b2ce5c2bc8623385d46fa05896a5fd6ce61a93abe069cb11e0f8fd3ee98cd83319e6b09580fef6b8b57a6163a8592ec079

  • SSDEEP

    12288:U9tpJ9zb1wqWIjX0n6j/PKJc3G5OF8wBjmqU888888888888W888888888884HMT:6ttzBwqWUX0c/W55GtQUMLIbvO

Score
10/10
neshtadiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      Utilman.exe

    • Size

      709KB

    • MD5

      83aba31021b2d4613af088f11f784301

    • SHA1

      906a0876fc94ad2e4ea10b3d6d61ca6788f1922d

    • SHA256

      de8f674e914b11d418860730c0297cd0a0ea44aa3d2bd58053d2c9a5b259a987

    • SHA512

      16cd85c45a035425ae9428ec657c60b2ce5c2bc8623385d46fa05896a5fd6ce61a93abe069cb11e0f8fd3ee98cd83319e6b09580fef6b8b57a6163a8592ec079

    • SSDEEP

      12288:U9tpJ9zb1wqWIjX0n6j/PKJc3G5OF8wBjmqU888888888888W888888888884HMT:6ttzBwqWUX0c/W55GtQUMLIbvO

    Score
    10/10
    neshtadiscoverypersistenceprivilege_escalationspywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks