Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 03:19
General
-
Target
c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be.exe
-
Size
627KB
-
MD5
1d56889095c80445fe070a698139e9de
-
SHA1
1142a8be42dd3761ea08ba6575027521b089ef37
-
SHA256
c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be
-
SHA512
3bea47099870f321f98cf9e87f486edf4f113df1ae171b57bb492a9bb135c3b9046ba9f1f40936c765969c4be8f3b4ba80f478018cf815145aa9da907ac25c02
-
SSDEEP
12288:Ym31gW73grFaJw1gQFK3CARY4x86PkcGL7rp:Ym3KWWAS1gQnqLxOL7
Malware Config
Signatures
-
Detect Neshta payload 6 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be.exe"C:\Users\Admin\AppData\Local\Temp\c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be.exe"C:\Users\Admin\AppData\Local\Temp\c2d5ca88f3cef3d7269927f81c706251b9f0d56c50969a800e0a7eadeede30be.exe"2⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5eda608cf3d86bba03f8cd540234b4ec0
SHA15b9a23b32e4b75981425919605ee5f2dd39ef50d
SHA2567cb2c2a297ef711cc26c070f9f22b35d98f42a2cbf087fee05dcd9dad4896aac
SHA51276c13f0becf11614e6ecec5addac75104988e7d28a4377bee91b385b27d17b24e52ebb8a88e9f88586bbe46907ef5b5bba3829c8951ea320b56b9f5c3f186255
-
Filesize
587KB
MD58b9a83d9a12df2d1a0df0be79579aeda
SHA158fda4bf40c9a1340ca4d45d41c2a4c3a95ea138
SHA256f68ff2ac4d65f6ee9025ba1376d26eae52df7be0cb9df936caa2b4527936dd98
SHA512f3d88c22c8bd9fe86421de345f77b4ef891f76c994dd6a0da452b656f4184b95dd815e2cabeb3e9cf3c281dc86e5e23733c8279f03c1a66253929e1c99872b24
-
Filesize
304KB
-
Filesize
448KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
656KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB