Overview

overview

10

Static

static

10

2024-12-18...ta.exe

windows7-x64

10

2024-12-18...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe

  • Size

    188KB

  • MD5

    69045be037a5cf8195966f57bb30e5c5

  • SHA1

    d4f157136a1b8f43c474b2eaf6cbe86ead68ff62

  • SHA256

    f6c31b093d8940526584290954905d42e87bd16dd88fb64a876216a4e7a3805a

  • SHA512

    dd02da0a0f0aa40324c0717848899deb8d83d48edcaf3ab021eea431764d6efeb52b7943fe04e5987dd92b7f4d8c960a9586906ad0785e78aa990f787e66b398

  • SSDEEP

    3072:sr85CDcSNm9V7DzY07RiY/JhsUogtP9bW3KVu5RTfqJogYg:k9Dc4m9tDzY079sUocPCIm1q2g

Score
10/10
lockbitneshtadefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Qoi6ifOVU.README.txt

Ransom Note
~~~ Cerber 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom EMAIL US - [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: AD7936094A57E972DDA8F085F3623B94 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. If you want to contact us, write in EMAIL [email protected]

Signatures

  • Detect Neshta payload 18 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Renames multiple (361) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 29 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\ProgramData\931B.tmp
        "C:\ProgramData\931B.tmp"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\931B.tmp >> NUL
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2644
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\931B.tmp >> NUL
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2976
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x150
    1⤵
      PID:1392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      b0493a141e106bd84b2f1afbcc25842d

      SHA1

      c3785c28f3990ac5269ee4d36da20e407cff4952

      SHA256

      df483a32b2d6195a1050f84a744beaf90bb7239883be53b03ead4a3da1c96ac9

      SHA512

      9199fdd2c066fe985b007ebe88b05bea7140f25a91b761744eb726e713d286471ccf97cf90b602a036577c21a2525176d7901a28a75e99ae53a1b5fab66703ba

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
      Filesize

      485KB

      MD5

      86749cd13537a694795be5d87ef7106d

      SHA1

      538030845680a8be8219618daee29e368dc1e06c

      SHA256

      8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

      SHA512

      7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
      Filesize

      674KB

      MD5

      97510a7d9bf0811a6ea89fad85a9f3f3

      SHA1

      2ac0c49b66a92789be65580a38ae9798237711db

      SHA256

      c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

      SHA512

      2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
      Filesize

      674KB

      MD5

      9c10a5ec52c145d340df7eafdb69c478

      SHA1

      57f3d99e41d123ad5f185fc21454367a7285db42

      SHA256

      ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

      SHA512

      2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{61087~1\VCREDI~1.EXE
      Filesize

      495KB

      MD5

      9597098cfbc45fae685d9480d135ed13

      SHA1

      84401f03a7942a7e4fcd26e4414b227edd9b0f09

      SHA256

      45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

      SHA512

      16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

      Download Submit

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

      Download Submit

    • C:\Qoi6ifOVU.README.txt
      Filesize

      1KB

      MD5

      43c2fb80d3ed716a6f46d61cfc05da10

      SHA1

      c8804d3954de30dadbd92e66ea9548ceb225d26d

      SHA256

      a487d5ec3bbeb2b44b6b802f75288351ceb687bd55c5b99bd8c3beb2b2b06b18

      SHA512

      33c7e31877ab243b53f85e11415bd730428491723148cb286dc7c5b0229e523b1f602b2dcffde3af4c7ca3599794ce6a5ab3e517ccdcebf2856b3147b20e17dd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
      Filesize

      147KB

      MD5

      97bae866c35421541eacf630163b55d6

      SHA1

      6a2276146e585fba4813c9d1bcd59bcb6cf68dfa

      SHA256

      e06b660c064c4ab0335d2a47c67e5383d427cdc2400bd750b07022e78c768d69

      SHA512

      4ad5b009d9536db9195e93dcdac618b5db6cd94186d46204f96c1697759f1374b33e3b50c2b2db73c4979e544b8d1dca0cf9ae426bcf566800c2b2e137c3663d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      f062bc197e9e42e632e1d0072a577737

      SHA1

      8ea94c5be90f45f2c647b8077b46a0b6cc426c85

      SHA256

      14f11db157cf91b6fe77ca6299fa9141ccc1d1a86450115db140d7bfb985d482

      SHA512

      b60bb241da9c4270366c8e13410b6b1dae75e06659a095c184e6dec5efe1a474eeb03bf49f49cc2ae6eb77e05a461396c518f7f78558589ab72dc6ab8427aed5

      Download Submit

    • C:\Windows\svchost.com
      Filesize

      40KB

      MD5

      36fd5e09c417c767a952b4609d73a54b

      SHA1

      299399c5a2403080a5bf67fb46faec210025b36d

      SHA256

      980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

      SHA512

      1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      7241f877d5f63fdbf38f6a4ae23f9de8

      SHA1

      c2a492c107080b0f2995749e7a2fa5e7b0768d71

      SHA256

      5d7f97245e069718d68fefd7638be8afc72e96e03a41929eae137f86b1e92555

      SHA512

      d9fad1557d1f2d1873983e878bf8baf305c5bf74526fe0778d19723090c7f5b22974f2cb97bb8246db49059fa934cd57e213951cd62e27a61fa13e2291b23c3e

      Download Submit

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

      Download Submit

    • \ProgramData\931B.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • \Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
      Filesize

      147KB

      MD5

      1d2ac566e1352e8934f62c2fcc212ca8

      SHA1

      fd15acde40a86dd0c8fbc47f22a74771d4f2f049

      SHA256

      a752c27ff76b8a4dee4748d5ac7cf57ae416ddb6acef7346ca2b2d333123699c

      SHA512

      814c409428c679c881f524d9a45f8ca000c6e9dc181314682a6db209140643642d6eaf9515f4e6d7d1f6bc2f24dc453ca96d71657dd16e47929f5dda345b1ef5

      Download Submit

    • \Users\Admin\AppData\Local\Temp\ose00000.exe
      Filesize

      145KB

      MD5

      9d10f99a6712e28f8acd5641e3a7ea6b

      SHA1

      835e982347db919a681ba12f3891f62152e50f0d

      SHA256

      70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

      SHA512

      2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

      Download Submit

    • memory/2644-1070-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2644-1078-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2644-1074-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2644-1068-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2644-1072-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-967-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1071-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1069-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1073-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1067-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1075-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2808-1079-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2868-14-0x0000000000270000-0x00000000002B0000-memory.dmp

      Filesize

      256KB

      Download