Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 07:19

General

  • Target

    3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe

  • Size

    1.5MB

  • MD5

    504f4094d8279d2fdd6a7804d5b752e0

  • SHA1

    fa51fc57e74821244432fa401060ea0f31e4b02e

  • SHA256

    3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674

  • SHA512

    cce910a06b28f196c1991e8eb0650e2de78455a74449de6764009be967e6290b6478004740dc54f9833b65799eaa6f068c3852f4769c14f9b675eec46c4f3cb8

  • SSDEEP

    49152:MbwdlPMoiO/xKkI0S+4TP2zpEomBIyeH8t:Mb1OpKkI0qTP2z+YHs

Malware Config

Signatures

  • Detect Neshta payload 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe
    "C:\Users\Admin\AppData\Local\Temp\3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\3582-490\3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:3396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\3ec69edfe6296cd2e4e92c42b14b250c3b4ba81bde92a1251234edd2c86a8674N.exe

    Filesize

    1.5MB

    MD5

    babee51ef9a02240515188921445ccd0

    SHA1

    4e4336a1f713f856642824fd091e94f122815309

    SHA256

    742bcf88a9ce092a376a310410e708ea299f9ab79cdd5ea3731bdaa1be3b77ee

    SHA512

    42d0d3f270eedf493e047fe3fb23c05371ac7567e4548d7084b0d2788e5e902798a61655dc332709e7d9edc7ad8c97ebd963d4c9d47541def9bfa092befdac44

  • memory/3396-11-0x0000000000410000-0x0000000000789000-memory.dmp

    Filesize

    3.5MB

  • memory/3396-98-0x0000000000E00000-0x0000000000EBE000-memory.dmp

    Filesize

    760KB

  • memory/3396-103-0x00000000016E0000-0x000000000170B000-memory.dmp

    Filesize

    172KB

  • memory/3396-102-0x0000000001580000-0x00000000016D6000-memory.dmp

    Filesize

    1.3MB

  • memory/3396-101-0x0000000001550000-0x0000000001577000-memory.dmp

    Filesize

    156KB

  • memory/3396-104-0x0000000001710000-0x000000000183A000-memory.dmp

    Filesize

    1.2MB

  • memory/3396-105-0x0000000001840000-0x000000000190D000-memory.dmp

    Filesize

    820KB

  • memory/3396-99-0x0000000001000000-0x00000000012C9000-memory.dmp

    Filesize

    2.8MB

  • memory/3396-97-0x0000000000410000-0x0000000000789000-memory.dmp

    Filesize

    3.5MB

  • memory/3396-100-0x00000000014A0000-0x000000000154C000-memory.dmp

    Filesize

    688KB

  • memory/3396-107-0x0000000002050000-0x00000000020A5000-memory.dmp

    Filesize

    340KB

  • memory/3396-110-0x00000000022C0000-0x000000000232B000-memory.dmp

    Filesize

    428KB

  • memory/3396-109-0x0000000002260000-0x00000000022C0000-memory.dmp

    Filesize

    384KB

  • memory/3396-106-0x0000000001910000-0x000000000204F000-memory.dmp

    Filesize

    7.2MB

  • memory/3396-111-0x0000000002330000-0x00000000025CA000-memory.dmp

    Filesize

    2.6MB

  • memory/3396-112-0x00000000025D0000-0x00000000027B4000-memory.dmp

    Filesize

    1.9MB

  • memory/3396-117-0x0000000002990000-0x0000000002A2E000-memory.dmp

    Filesize

    632KB

  • memory/3396-119-0x0000000002AD0000-0x0000000002BFA000-memory.dmp

    Filesize

    1.2MB

  • memory/3396-118-0x0000000002A30000-0x0000000002ACB000-memory.dmp

    Filesize

    620KB

  • memory/3396-113-0x00000000027C0000-0x0000000002969000-memory.dmp

    Filesize

    1.7MB

  • memory/3396-116-0x0000000002980000-0x000000000298A000-memory.dmp

    Filesize

    40KB

  • memory/3396-115-0x0000000002970000-0x000000000297C000-memory.dmp

    Filesize

    48KB

  • memory/3396-114-0x0000000000BF0000-0x0000000000BF7000-memory.dmp

    Filesize

    28KB

  • memory/3396-108-0x00000000020B0000-0x0000000002251000-memory.dmp

    Filesize

    1.6MB

  • memory/3396-122-0x0000000002D00000-0x0000000002D22000-memory.dmp

    Filesize

    136KB

  • memory/3396-121-0x0000000002E30000-0x0000000002F3B000-memory.dmp

    Filesize

    1.0MB

  • memory/3396-127-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

    Filesize

    72KB

  • memory/3396-128-0x0000000004BF0000-0x0000000004C1C000-memory.dmp

    Filesize

    176KB

  • memory/3396-126-0x00000000035F0000-0x0000000003620000-memory.dmp

    Filesize

    192KB

  • memory/3396-125-0x0000000003340000-0x0000000003371000-memory.dmp

    Filesize

    196KB

  • memory/3396-123-0x0000000002F40000-0x0000000003295000-memory.dmp

    Filesize

    3.3MB

  • memory/3396-129-0x0000000004C20000-0x00000000053B0000-memory.dmp

    Filesize

    7.6MB

  • memory/3396-144-0x0000000006A20000-0x0000000006A2A000-memory.dmp

    Filesize

    40KB

  • memory/3396-146-0x0000000006630000-0x000000000664D000-memory.dmp

    Filesize

    116KB

  • memory/3396-153-0x000000000C2E0000-0x000000000C3D9000-memory.dmp

    Filesize

    996KB

  • memory/3396-160-0x000000000D440000-0x000000000D467000-memory.dmp

    Filesize

    156KB

  • memory/3396-159-0x000000000C9A0000-0x000000000C9DB000-memory.dmp

    Filesize

    236KB

  • memory/3396-158-0x000000000C980000-0x000000000C995000-memory.dmp

    Filesize

    84KB

  • memory/3396-157-0x000000000C9E0000-0x000000000CB34000-memory.dmp

    Filesize

    1.3MB

  • memory/3396-156-0x000000000C840000-0x000000000C873000-memory.dmp

    Filesize

    204KB

  • memory/3396-155-0x000000000C4E0000-0x000000000C83E000-memory.dmp

    Filesize

    3.4MB

  • memory/3396-154-0x000000000C3E0000-0x000000000C4D2000-memory.dmp

    Filesize

    968KB

  • memory/3396-152-0x000000000C230000-0x000000000C2DC000-memory.dmp

    Filesize

    688KB

  • memory/3396-151-0x000000000AAD0000-0x000000000AADD000-memory.dmp

    Filesize

    52KB

  • memory/3396-150-0x00000000071F0000-0x0000000007221000-memory.dmp

    Filesize

    196KB

  • memory/3396-149-0x00000000071D0000-0x00000000071EF000-memory.dmp

    Filesize

    124KB

  • memory/3396-148-0x0000000006660000-0x0000000006683000-memory.dmp

    Filesize

    140KB

  • memory/3396-147-0x0000000007130000-0x00000000071C1000-memory.dmp

    Filesize

    580KB

  • memory/3396-145-0x0000000006290000-0x00000000063A5000-memory.dmp

    Filesize

    1.1MB

  • memory/3396-143-0x0000000006A10000-0x0000000006A1C000-memory.dmp

    Filesize

    48KB

  • memory/3396-142-0x00000000069D0000-0x0000000006A04000-memory.dmp

    Filesize

    208KB

  • memory/3396-141-0x0000000005D80000-0x0000000005D98000-memory.dmp

    Filesize

    96KB

  • memory/3396-140-0x0000000005A00000-0x0000000005A08000-memory.dmp

    Filesize

    32KB

  • memory/3396-139-0x0000000005D40000-0x0000000005D7B000-memory.dmp

    Filesize

    236KB

  • memory/3396-138-0x0000000006790000-0x000000000685C000-memory.dmp

    Filesize

    816KB

  • memory/3396-137-0x0000000005DB0000-0x0000000005E1A000-memory.dmp

    Filesize

    424KB

  • memory/3396-136-0x0000000005950000-0x00000000059EE000-memory.dmp

    Filesize

    632KB

  • memory/3396-135-0x0000000005E70000-0x0000000005E89000-memory.dmp

    Filesize

    100KB

  • memory/3396-134-0x0000000005890000-0x0000000005939000-memory.dmp

    Filesize

    676KB

  • memory/3396-133-0x00000000057F0000-0x0000000005873000-memory.dmp

    Filesize

    524KB

  • memory/3396-132-0x00000000057D0000-0x00000000057E2000-memory.dmp

    Filesize

    72KB

  • memory/3396-131-0x00000000053E0000-0x000000000548D000-memory.dmp

    Filesize

    692KB

  • memory/3396-130-0x00000000053B0000-0x00000000053DC000-memory.dmp

    Filesize

    176KB

  • memory/3396-124-0x00000000032A0000-0x000000000333D000-memory.dmp

    Filesize

    628KB

  • memory/3396-120-0x0000000002C00000-0x0000000002D00000-memory.dmp

    Filesize

    1024KB