neshta | 4643136e8fcd4d00adb45cd272ad216ad79dd1380530e0c9e33049db5e419fd5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe
Size

178KB
MD5

0377ab0ac1f5b6637d73f532feca03d7
SHA1

5f2919db9c0358acf9f60d419c11c40d9f4b513c
SHA256

4643136e8fcd4d00adb45cd272ad216ad79dd1380530e0c9e33049db5e419fd5
SHA512

fbaa5e90463e9c4261470ba09ad23173a95fc9bd7825e4dc5e337131c36932c07f1d39d50dcb321d8824556f1bb59f82c0a014a3323ca0b32587b0559b6c2a80
SSDEEP

3072:DaGj4bpgPvWlQnLxGHuG/JFONMJTYfu6oUWAwMr85CT:OGYgXWlQwbJFOSJcW6CE9

Score

10^/10

neshta discovery persistence spyware

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015e25-2.dat	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Executes dropped EXE 1 IoCs

pid	Process
3068	Au_.exe

Loads dropped DLL 6 IoCs

pid	Process
2884	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe
3068	Au_.exe
3068	Au_.exe
3068	Au_.exe
3068	Au_.exe
3068	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3068	2884	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe	30
PID 2884 wrote to memory of 3068	2884	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe	30
PID 2884 wrote to memory of 3068	2884	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe	30
PID 2884 wrote to memory of 3068	2884	JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0377ab0ac1f5b6637d73f532feca03d7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst64DD.tmp\LangDLL.dll

Filesize
5KB

MD5
be828e6e1885cc5a25e18f123e2a76a0

SHA1
96432bf2da4e1c454f49f76e20855f27c2fce2f9

SHA256
01773690efda3c1fa609287f4bf2277f3d366fe4a1ddc099d2949fab54f0fbd4

SHA512
983e9a9e941b162031b8acf372c3ec12180b54f8e5f7172a6e87599e127170240841889d6e346a730f4970c9079f5f9cededc2730f910eb4e0bb897f68cfca70

Download Submit
\Users\Admin\AppData\Local\Temp\nst64DD.tmp\ShellLink.dll

Filesize
4KB

MD5
d62d3e349689811f838dd10fb216eba1

SHA1
edcafd517860cb6b4bd299e20b17ad74a6fa2a5d

SHA256
5d103419245e2a5f124a96cace25d6836b2398edc0aa3919829b0fd6ad8b5d6a

SHA512
fc7d5826cb9f85068ea702f007920bf7ae63758d13c48761e83cc9e8ac06b231f40e17a9f3340d60d874ad2cf6e0991eb98a52cf893ab785489e0cdbbf294f88

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Filesize
178KB

MD5
0377ab0ac1f5b6637d73f532feca03d7

SHA1
5f2919db9c0358acf9f60d419c11c40d9f4b513c

SHA256
4643136e8fcd4d00adb45cd272ad216ad79dd1380530e0c9e33049db5e419fd5

SHA512
fbaa5e90463e9c4261470ba09ad23173a95fc9bd7825e4dc5e337131c36932c07f1d39d50dcb321d8824556f1bb59f82c0a014a3323ca0b32587b0559b6c2a80

Download Submit