neshta | 61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cf

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Size

7.2MB
MD5

05442d4ae12dcdbe66842668eff47790
SHA1

7325d4e70648f103bea78c6005c54087389925c3
SHA256

61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cf
SHA512

7a9798a395c1ea133ec15ea2d09f9f3527083f5ced4be7b21db1d170a86f06fed282e4b189eb74d93a564f29e36b6178f969f000d7472fe40718d976b850e742
SSDEEP

196608:Ye4cH6mibEdWLfvnEQFwbBEPbaJzQX1zt9y8T7wUbGLa7/c:mcHM4MDEkOBEPwzc1z9TZ/c

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0006000000020241-30.dat	family_neshta
behavioral2/memory/4812-115-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4812-116-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4812-118-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Executes dropped EXE 3 IoCs

pid	Process
3164	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
3992	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Loads dropped DLL 1 IoCs

pid	Process
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\combase.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\win32u.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\GDI32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\ole32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\imm32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\shcore.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\psapi.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\Dbghelp.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\user32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\shell32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\Wldp.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\advapi32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\sechost.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeTcbPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeTcbPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeLoadDriverPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeCreateGlobalPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeLockMemoryPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: 33	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeSecurityPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeTakeOwnershipPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeManageVolumePrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeBackupPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeCreatePagefilePrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeShutdownPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeRestorePrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: 33	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
Token: SeIncBasePriorityPrivilege	4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3164	4812	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	82
PID 4812 wrote to memory of 3164	4812	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	82
PID 4812 wrote to memory of 3164	4812	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	82
PID 3164 wrote to memory of 3992	3164	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	83
PID 3164 wrote to memory of 3992	3164	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	83
PID 3164 wrote to memory of 3992	3164	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	83
PID 3992 wrote to memory of 4824	3992	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	84
PID 3992 wrote to memory of 4824	3992	61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe	84

C:\Users\Admin\AppData\Local\Temp\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
"C:\Users\Admin\AppData\Local\Temp\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\3582-490\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
    "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\3582-490\"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe
      C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\3582-490\"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Filesize
7.2MB

MD5
38926368b538ed4c1e24cd120d8dffcb

SHA1
cf51e4e6f90ad6d6659698c282344e7f3a2fab94

SHA256
b7d6e3039507ddb308abfcae448095c64e005ece8a5e1d6ad80b543dcff34cdc

SHA512
e7dd24462d2c9956458d2492ede3936d4477eedb4645104f8ce06eb97b1209d91298c28ef4cb8460b95d950b91b228cbba5900087b14e25c13d0d4a414aa5f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Filesize
225KB

MD5
971b37cedf686e0ac8ca0297a953aad9

SHA1
8ea777fa6c70a619d4e92cc6435c4eba2b16a23e

SHA256
1965546a19990b4523a1588eb0d7fdd42bd443e2bcc632dae04343d358394ae7

SHA512
2f0f3facf2587b751bb658eaab9ca1536d7326956b0eeca7bd0badc893c0878741f8bb56d8c1e360f2cb4bd9442866bd9faf7bdec7d02105f6c149640cf180d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\CET_Archive.dat

Filesize
6.9MB

MD5
87cc814472f706a8d83df6d4bb1e3af6

SHA1
26db0e4e4d2d8060cc4ceb5b46460f9dc13f22eb

SHA256
f85383da75e8659ad4656732176f334cef51b76acd21bc57b87683f6aeac6bcd

SHA512
dc12f22968369a69ed82add2faa7b7528a53e40e39034ea65332c0d34d2c8983d7a8910394ab0c85a40821d7a5d5c6eb335fe8069bd3665caea80b824ca8e087

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\61469bc9a1f5ec581a481817f4a701c4743c6bccd4d180f7fd5c14153986a2cfN.exe

Filesize
15.9MB

MD5
edeef697cbf212b5ecfcd9c1d9a8803d

SHA1
e90585899ae4b4385a6d0bf43c516c122e7883e2

SHA256
ac9bcc7813c0063bdcd36d8e4e79a59b22f6e95c2d74c65a4249c7d5319ae3f6

SHA512
1aaa8fc2f9fafecbe88abf07fbc97dc03a7c68cc1d870513e921bf3caeaa97128583293bf5078a69aecbb93bf1e531605b36bd756984db8d703784627d1877d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\CET_TRAINER.CETRAINER

Filesize
158KB

MD5
2e9271bf85b6168648c4e0ebab2000d6

SHA1
f76727741647a76de0f5d056b41e782c6b084490

SHA256
81f9a60116b7649fd4c136978b48db488dd781e87d496cc3377a83291b6568ef

SHA512
549fd40c9e03ff194f72508cefc75cbcf8d7a0e336b5ff12bbb888a256a3314cf1d81e03dcf40722a2e10f9bb25bead093b86523b4116a04145067faba8c7952

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\autorun\luasymbols.lua

Filesize
629B

MD5
df4d243ab0407a1f03ccf448232fcf62

SHA1
62453cfa7abf6fa83158be1ba86c854d9a6b7d4b

SHA256
c5a35380af8bebe96b85377f5f41f8c068cb857c74b9cb85b7467b35c1de10c4

SHA512
4b05b65909673e92f59ab64c1ff4e0b829f5c9085eafa1fff28cb0ccd7e6a7f6ef031633f443e0ba156a4b8f5009f526d0356f39ef77b22706f98f100b1909c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\autorun\monoscript.lua

Filesize
132KB

MD5
76168ca68f3ed8ade110b140244efbaf

SHA1
2af08403d17a64b10429c8fce68aa085a6b287b7

SHA256
5832b5ab00e84690ac1e780e8b1c4abd9649465234c9ffa2cecb410be66a6b8a

SHA512
80ad21d631934d2b8e368a5b2d3cb5f1889d4a65099c2d8cd8ba37eb721c1ebdc2c6549fc530514bf9f96976ffcbfd372150f1f16a6591da013fe4f1d1bb070b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\defines.lua

Filesize
12KB

MD5
62e1fa241d417668f7c5da6e4009a5a6

SHA1
f887409e3c204a87731f317a999dc7e4cc8d3fcd

SHA256
82e8ef7df20a86791cef062f2dcacb1d91b4adc9f5dea2fd274886be8365b2f8

SHA512
2283cbb9e1d5d53ad1ed9bc9db6034fb3c53c633b11001f373523640bbbba95da9a3a0866c7d5fa0620facab7d18c8577dfd69496fc7319e0a4a74d0b9e10c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETBB70.tmp\extracted\lua53-64.dll

Filesize
528KB

MD5
b7c9f1e7e640f1a034be84af86970d45

SHA1
f795dc3d781b9578a96c92658b9f95806fc9bdde

SHA256
6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff

SHA512
da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3

Download Submit
memory/4812-115-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4812-116-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4812-118-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download