neshta | 8b2a368965731bd3eeda7fb5e4998e367c24ef7ae71c50394363a9448373ce15

Analysis

max time kernel
95s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

re.exe
Size

7.0MB
MD5

2f257ead7f42df4e9115ddab552e77e4
SHA1

84e1e63ea102e3f50b6f87e396e53df8ef6e20d5
SHA256

8b2a368965731bd3eeda7fb5e4998e367c24ef7ae71c50394363a9448373ce15
SHA512

336246379fb20f818e1de05276c7954249130d478a6ab252748ee3ee9ea88265bf7438415f594819e78b0dec61deb92d2742dbc9ecda269cabbdd2c1995b498d
SSDEEP

196608:OXzvm6eIrZ3K3xnLZGTIB4M+IFQyXI5qF:z1I130xgxIFQyXGC

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 6 IoCs

resource	yara_rule
behavioral2/memory/980-0-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/files/0x0006000000020253-41.dat	family_neshta
behavioral2/memory/980-131-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/980-130-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/980-132-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral2/memory/980-134-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	re.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	re.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	re.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SIMPLE~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	re.exe
File opened for modification	C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SESSIO~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	re.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	re.exe
File opened for modification	C:\PROGRA~3\JWRAPP~1\JWRAPP~1\elev_win.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	re.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	re.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	re.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	re.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	re.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	re.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	re.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	re.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	re.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	re.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	re.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2536	980	re.exe	83
PID 980 wrote to memory of 2536	980	re.exe	83

C:\Users\Admin\AppData\Local\Temp\re.exe
"C:\Users\Admin\AppData\Local\Temp\re.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
a40427e3788637e741fb69ea8d76cd52

SHA1
f8c8c7ec493e32a7573d90ce400fccd79fc98f31

SHA256
18dcc8fae245869d02b7db0edbe22ec57a30bdd51a64090452118a79ba194052

SHA512
e6b688d4ad0506c74db323b50a2588472f45e66da2a3456450aea96d93882b13662f8b3bbed7773180f5bec851a31d2e45262ecb9283b425c60c8caa06d56ca2

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SESSIO~1.EXE

Filesize
192KB

MD5
fc4fe7166a0bbdf00f6152a38c446214

SHA1
1c52036be5c21d58cbd77f5ef058126b4133d7df

SHA256
8197d112a04c12666fc88363f41d1ee25f3ac70332126c75652ecc77da8de7e2

SHA512
b265915e487cce7548c9d808a67d5fd4d68c3247b16dce0ba874d0731b3b4cca2c44a5a14a2df52162c4c7a3d63fbb73a7475aafde032a809ee949bd5bd5becc

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\SIMPLE~1.EXE

Filesize
286KB

MD5
e7f68701273c67c3afa66cf352f4fe09

SHA1
e4cda58a1c24646b95a2f7e4a4ab5523ac565ccc

SHA256
c4e902aec3069f89fadd2fbd77fada9087bb9db5d20127c5de80b021f673d931

SHA512
7ed72053db799f984fb4fe224a05107fa885d014c1725c581417b08d88cfb0d1dd74e8ad7541fba6038ac4da3d79167ad5d795d244b7e5974bb3a0cbc73ab8b5

Download Submit
C:\PROGRA~3\JWRAPP~1\JWRAPP~1\elev_win.exe

Filesize
238KB

MD5
7e2f6d98a5349a22e5be11b83cf9c696

SHA1
23f4c25510b3272a7a9e18233609f6d55dceb8ca

SHA256
5b87ca45360d5bc75374312769b6120b4bcd9666ff00e05cbe980e7298b1baec

SHA512
4fbac0edb3c886045c6c98c6551affefacb1fe6f4251fae157108e853c5cc94676c78134c551114cee34d61c2de7332af58d20ef037084b8a201e27315256519

Download Submit
C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\nativesplash.png

Filesize
8KB

MD5
08051133e368d61036576d3ed5b9cc14

SHA1
817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5

SHA256
5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7

SHA512
93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\re.exe

Filesize
7.0MB

MD5
25b6f3f4b13bc53dd4981915cdd95e33

SHA1
d45348d67a362c46cd2cd3c2fa1e8e5a32721f34

SHA256
75ef7f52bd7ca4b2ebea210f96586c486b4e635cda01d0a7d9fc461210ed0cc1

SHA512
47d5d612cbe9c87645aa0887c58df7ef51a676c3115601366dd8a6fbf9989beb75b1b279bb8f8b3e67eef20d3960a7177cbbb558eca93fff2d7ed6b47c4076c0

Download Submit
memory/980-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/980-131-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/980-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/980-132-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/980-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads