neshta | 8b2a368965731bd3eeda7fb5e4998e367c24ef7ae71c50394363a9448373ce15

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

re.exe
Size

7.0MB
MD5

2f257ead7f42df4e9115ddab552e77e4
SHA1

84e1e63ea102e3f50b6f87e396e53df8ef6e20d5
SHA256

8b2a368965731bd3eeda7fb5e4998e367c24ef7ae71c50394363a9448373ce15
SHA512

336246379fb20f818e1de05276c7954249130d478a6ab252748ee3ee9ea88265bf7438415f594819e78b0dec61deb92d2742dbc9ecda269cabbdd2c1995b498d
SSDEEP

196608:OXzvm6eIrZ3K3xnLZGTIB4M+IFQyXI5qF:z1I130xgxIFQyXGC

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 8 IoCs

resource	yara_rule
behavioral2/memory/1764-0-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/files/0x0006000000020253-31.dat	family_neshta
behavioral2/files/0x0007000000023cb6-98.dat	family_neshta
behavioral2/files/0x0007000000023cb8-100.dat	family_neshta
behavioral2/memory/1764-130-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/1764-131-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/1764-132-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/1764-134-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	re.exe

Executes dropped EXE 1 IoCs

pid	Process
3556	re.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	re.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	re.exe
File opened for modification	C:\PROGRA~3\JWRAPP~1\JWRAPP~1\elev_win.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	re.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	re.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	re.exe
File opened for modification	C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SIMPLE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	re.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	re.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	re.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	re.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	re.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3556	1764	re.exe	82
PID 1764 wrote to memory of 3556	1764	re.exe	82

C:\Users\Admin\AppData\Local\Temp\re.exe
"C:\Users\Admin\AppData\Local\Temp\re.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe"
  2⤵
  - Executes dropped EXE
  PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
a40427e3788637e741fb69ea8d76cd52

SHA1
f8c8c7ec493e32a7573d90ce400fccd79fc98f31

SHA256
18dcc8fae245869d02b7db0edbe22ec57a30bdd51a64090452118a79ba194052

SHA512
e6b688d4ad0506c74db323b50a2588472f45e66da2a3456450aea96d93882b13662f8b3bbed7773180f5bec851a31d2e45262ecb9283b425c60c8caa06d56ca2

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SESSIO~1.EXE

Filesize
192KB

MD5
6d70156b504ffc91cdac5d3e788c671e

SHA1
22ae011dbe4e6e211b0b8e907d6c439dcb3963c1

SHA256
659306d60277ed05a4a969f92fea912c3daec79a07258a94c461ae8bc4c3f42d

SHA512
6e128f8fd8da5fa24da30943a7f6a505eb8d358f65a440d67314baeeffb8ca623d0aebd01d035fab20832bae265dfad422b20489572248e10d6752f31cc18e5c

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SIMPLE~1.EXE

Filesize
286KB

MD5
b61b2dab11207e87aa293de007d60b7d

SHA1
c1dd3a1077eac1483acb1e2cac78d4cfd5d96a78

SHA256
7559c8bda5fd84d9f37f327a3b568b3f5aa9b21456cb9511f67fe1627e75c697

SHA512
7be70b20bcccba99eb65272407c5346ddf1d3b46c5f5ed6efa57bf1247224f32ea6f93fd551141b6deef177ec83601413353cae6d5db28f76e63d12c602a3bc9

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\elev_win.exe

Filesize
278KB

MD5
ccdeb234eee742973bd9b77d269fb2fd

SHA1
5a677cb0a4bc6f2b28bc5f7bd3336da8ec94ed63

SHA256
d06af6f96e70c6aae3f7da05c111169b6ea38a9dd85d9600559efa1d5d51de95

SHA512
d7e37cd8346504354738ce75872fe2f137e6750c46c7ecb4d246ce0c6310115c51cdba6dad8271529e472fbf1007e80e679cff036a36cd543c5a8166c0177561

Download Submit
C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\nativesplash.png

Filesize
8KB

MD5
08051133e368d61036576d3ed5b9cc14

SHA1
817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5

SHA256
5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7

SHA512
93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe

Filesize
7.0MB

MD5
25b6f3f4b13bc53dd4981915cdd95e33

SHA1
d45348d67a362c46cd2cd3c2fa1e8e5a32721f34

SHA256
75ef7f52bd7ca4b2ebea210f96586c486b4e635cda01d0a7d9fc461210ed0cc1

SHA512
47d5d612cbe9c87645aa0887c58df7ef51a676c3115601366dd8a6fbf9989beb75b1b279bb8f8b3e67eef20d3960a7177cbbb558eca93fff2d7ed6b47c4076c0

Download Submit
memory/1764-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-131-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-132-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads