Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-12-2024 16:21
Behavioral task
behavioral1
Sample
1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe
Resource
win11-20241007-en
windows11-21h2-x64
18 signatures
150 seconds
General
-
Target
1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe
-
Size
2.0MB
-
MD5
5fbca2e5cb2da5756c2b22327de906ed
-
SHA1
3f00d1375dfe492ba6ae4335a94ed6d13e5b9171
-
SHA256
3382e972bc510ae3bc77db416fb07fbc80f5d56cf4a7f177a6608427fafed8f4
-
SHA512
14fcfff0c8af8a4bf67c3897cc33faca268f3401b0fec42f06676179cae03926265a64b6abc0ec4a0536eee6475650e7c0489cbca564eaf285fcf993bd9a6ced
-
SSDEEP
12288:BJIJhk7lHfbtcidl5TYyUyQc8uHgo2aYdwodR:BJ2hAlHjjnSDuAxasn
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 5 IoCs
resource yara_rule behavioral1/files/0x001e00000002aa89-10.dat family_neshta behavioral1/files/0x0005000000027946-82.dat family_neshta behavioral1/memory/916-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/916-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/916-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts svchost.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk sysapp.exe -
Executes dropped EXE 3 IoCs
pid Process 3380 sysapp.exe 916 PayChecker.exe 2212 PayChecker.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" PayChecker.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\{0B14DC07FA833071859460}\\{0B14DC07FA833071859460}.exe" sysapp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3380 set thread context of 3400 3380 sysapp.exe 79 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedgewebview2.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\msedge_proxy.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\notification_helper.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\pwahelper.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe PayChecker.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe PayChecker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe PayChecker.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\BHO\ie_to_edge_stub.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE PayChecker.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge.exe PayChecker.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\elevation_service.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge_pwa_launcher.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe PayChecker.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe PayChecker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe PayChecker.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE PayChecker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\cookie_exporter.exe PayChecker.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\pwahelper.exe PayChecker.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe PayChecker.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com PayChecker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PayChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PayChecker.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" PayChecker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3380 sysapp.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3380 sysapp.exe Token: SeSecurityPrivilege 3380 sysapp.exe Token: SeTakeOwnershipPrivilege 3380 sysapp.exe Token: SeLoadDriverPrivilege 3380 sysapp.exe Token: SeSystemProfilePrivilege 3380 sysapp.exe Token: SeSystemtimePrivilege 3380 sysapp.exe Token: SeProfSingleProcessPrivilege 3380 sysapp.exe Token: SeIncBasePriorityPrivilege 3380 sysapp.exe Token: SeCreatePagefilePrivilege 3380 sysapp.exe Token: SeBackupPrivilege 3380 sysapp.exe Token: SeRestorePrivilege 3380 sysapp.exe Token: SeShutdownPrivilege 3380 sysapp.exe Token: SeDebugPrivilege 3380 sysapp.exe Token: SeSystemEnvironmentPrivilege 3380 sysapp.exe Token: SeRemoteShutdownPrivilege 3380 sysapp.exe Token: SeUndockPrivilege 3380 sysapp.exe Token: SeManageVolumePrivilege 3380 sysapp.exe Token: 33 3380 sysapp.exe Token: 34 3380 sysapp.exe Token: 35 3380 sysapp.exe Token: 36 3380 sysapp.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3380 3952 1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe 77 PID 3952 wrote to memory of 3380 3952 1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe 77 PID 3952 wrote to memory of 916 3952 1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe 78 PID 3952 wrote to memory of 916 3952 1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe 78 PID 3952 wrote to memory of 916 3952 1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe 78 PID 3380 wrote to memory of 3400 3380 sysapp.exe 79 PID 3380 wrote to memory of 3400 3380 sysapp.exe 79 PID 3380 wrote to memory of 3400 3380 sysapp.exe 79 PID 916 wrote to memory of 2212 916 PayChecker.exe 80 PID 916 wrote to memory of 2212 916 PayChecker.exe 80 PID 916 wrote to memory of 2212 916 PayChecker.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe"C:\Users\Admin\AppData\Local\Temp\1a5a11f3-dc1f-42ad-b31d-186066997d0d (1).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Roaming\sysapp.exe"C:\Users\Admin\AppData\Roaming\sysapp.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
-
-
C:\Users\Admin\AppData\Local\Temp\PayChecker.exe"PayChecker.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\PayChecker.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\PayChecker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD539c8a4c2c3984b64b701b85cb724533b
SHA1c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA256888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
SHA512f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
-
Filesize
1.5MB
MD57980ae935f0bbc9740653efb6a16d380
SHA1a0b9a1e3baa0c168252cd77972c6bbb3d9a97389
SHA256420028c19b27489ec1c57159c4611b28a78b8c4183cbaa0bcba90d28448890ba
SHA5123389946df7d4d2cc6577be2dfd5a50d45f053d736d0b725b60acbf09ca5dbd9ab28056d1ccc2abac35ddbfe85f1b314cdb1d5467c0c616dc99e572e948b257e2
-
Filesize
1.6MB
MD5b2cc36f6b742d6700279d1766d30b9e3
SHA11cad4796fa844fc071a4bf49d54fee479df0e0db
SHA25607d7deaf6dd32d9fff4ceea1a180824c28b4d10f3f4ff12520476d1e184723df
SHA51264d2aada159538c5a6f370ea94903a4730aa953873360f99049d6046ffdb2f5657c17a2c4760aeffda4cb8076cad31f5f6bc8d04401bbbf5b299bb62199172bc
-
Filesize
278KB
MD58a3a576d178ac1abbd9e1c58d00d4afd
SHA128ee0f532ab1df4a9a589aa66c6537bebb32751e
SHA2562786dfc70c53aaef43bfe38177962278530c1593cb3e0c096e88facec0e2f803
SHA512a641973d0f67c9c4d65a6429b83bbc29a011bdc9ac4f4d57bb88e2dff6ecbbb1db91bb5d280098897f24766f0313004730273d87cbbeb2986caed8d8ca55aa1e
-
Filesize
1KB
MD57aed163a7c554d2c86de68d11a55d030
SHA18416928fbe1aa0ab181a6d6abe1e30ef82ea25ea
SHA256b5f1a672f239b65afa1f8e8a0b7da5f793e9ff6f3f8aff2818c6c635f0b360b9
SHA5126dc00db724ce2567754a79fc3f5e0e2133abad323ced5beed053fd51f93227c3e263e008ada5f853cf47a27080a66ef921c2c210be7386d589383fcb984b3cfd