General
-
Target
3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe
-
Size
1.5MB
-
Sample
241218-h5x9laypfv
-
MD5
504f4094d8279d2fdd6a7804d5b752e0
-
SHA1
fa51fc57e74821244432fa401060ea0f31e4b02e
-
SHA256
3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674
-
SHA512
cce910a06b28f196c1991e8eb0650e2de78455a74449de6764009be967e6290b6478004740dc54f9833b65799eaa6f068c3852f4769c14f9b675eec46c4f3cb8
-
SSDEEP
49152:MbwdlPMoiO/xKkI0S+4TP2zpEomBIyeH8t:Mb1OpKkI0qTP2z+YHs
Behavioral task
behavioral1
Sample
3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe
Resource
win7-20240729-en
Malware Config
Targets
-
-
Target
3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe
-
Size
1.5MB
-
MD5
504f4094d8279d2fdd6a7804d5b752e0
-
SHA1
fa51fc57e74821244432fa401060ea0f31e4b02e
-
SHA256
3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674
-
SHA512
cce910a06b28f196c1991e8eb0650e2de78455a74449de6764009be967e6290b6478004740dc54f9833b65799eaa6f068c3852f4769c14f9b675eec46c4f3cb8
-
SSDEEP
49152:MbwdlPMoiO/xKkI0S+4TP2zpEomBIyeH8t:Mb1OpKkI0qTP2z+YHs
-
Detect Neshta payload
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1