Analysis
-
max time kernel
37s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-01-2025 05:33
Behavioral task
behavioral1
Sample
Slaxe Destoryer.exe
Resource
win11-20241007-en
windows11-21h2-x64
14 signatures
900 seconds
General
-
Target
Slaxe Destoryer.exe
-
Size
7.7MB
-
MD5
9b085f506727922f7e2aeb7a2468351e
-
SHA1
3f73a15e2c49ad9c63c23f34539752ed6b07e6c9
-
SHA256
82d1e485784c04dbbd03a61be127b63337be9807dfc1dd05cf6b7e5b478dec5e
-
SHA512
514f98ae272309395f9e3d1bfac15f2c6f1a4fcd8c61183c3cbf7999fa4c72e908fa82ca19a1d338b78e41c942c274693565d294a4433cdac15933865935e075
-
SSDEEP
196608:rYqfGZEx/qa+f5FaieIqzCEVt+re4dwLUFq+QzlMWKpMgHg:rPGuxSa+RFai9vrnwLUNKlMDdg
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 4 IoCs
resource yara_rule behavioral1/files/0x000700000002782a-23.dat family_neshta behavioral1/memory/4156-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4156-131-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4156-133-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 1 IoCs
pid Process 4112 Slaxe Destoryer.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Slaxe Destoryer.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\msedge_proxy.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\cookie_exporter.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\pwahelper.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\identity_helper.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedgewebview2.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge_pwa_launcher.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\Installer\setup.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge_proxy.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\pwahelper.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\BHO\ie_to_edge_stub.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE Slaxe Destoryer.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe Slaxe Destoryer.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Slaxe Destoryer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Slaxe Destoryer.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Slaxe Destoryer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe 4112 Slaxe Destoryer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4112 Slaxe Destoryer.exe Token: 33 2064 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2064 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4112 4156 Slaxe Destoryer.exe 77 PID 4156 wrote to memory of 4112 4156 Slaxe Destoryer.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slaxe Destoryer.exe"C:\Users\Admin\AppData\Local\Temp\Slaxe Destoryer.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Slaxe Destoryer.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Slaxe Destoryer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53b73078a714bf61d1c19ebc3afc0e454
SHA19abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA51275959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
-
Filesize
7.7MB
MD55c8a965693115e8d47c18445fc2ddb45
SHA1cf89e1bae46baa96718efd3aad0fddbc887ae140
SHA256e608bf81fcb5cfbb1b7f4b5e84d80c49b4240948332f396d3e2752c5bcdd5fe8
SHA51250bed51ebb8750885401fdad9be05cff570f396163a7a5e520a62e02c377d060ad0c593cdc7298f36cc2d8c98df7eace7ef68def152ea9d7e4cecb97a5fc043b