neshta | f5dc4bff3077f9ea363e0c4d080227b24f3ea014444c462e146b2d48fb83e451

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe
Size

140KB
MD5

fb0865f8740aae0d1421c601fda4c5fd
SHA1

825f59e9b7c763be93053ed8000a76235e72952a
SHA256

f5dc4bff3077f9ea363e0c4d080227b24f3ea014444c462e146b2d48fb83e451
SHA512

f0f2c0f0b03174cfaa71bd97ce9842de019926d06655a83e920489cb23479d1d64979ca801fecdad0b94c1f561c7637654556c21a4dd8f036a29f30c99387e06
SSDEEP

3072:Prr85Cj50x3ViiOAJ1aWyUEJEcuUhzeS8KwpIqE7jOwgWf3G:v9juNLGWVEeHUhzlwV

Score

10^/10

neshta discovery persistence spyware

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000400000-0x000000000041B252-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2212	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2124	2212	fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2124	2212	fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2124	2212	fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2124	2212	fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb0865f8740aae0d1421c601fda4c5fd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 148
  2⤵
  - Program crash
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000400000-0x000000000041B252-memory.dmp

Filesize
108KB

Download