Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
23-01-2025 15:59
General
-
Target
officedeploymenttool_11509-33604.exe
-
Size
2.8MB
-
MD5
b4bf5401ac999a46a265c92d5606a27c
-
SHA1
18f917aac8f5380d280a25d0abfbd8207bc1ee96
-
SHA256
ea7933f59d7a4ebe420c5c80cabea3ca183cd040f3d047360bdb0b71c2921844
-
SHA512
fe3c40f237c669849641f0cf1d49d627bdab7b7399369900a49711d8036e080769da95a96f012b07f01731d536894982b2efa1d3620eb9cd08ab9c54cb35346d
-
SSDEEP
49152:LpIsZSxQ0O+cAtWreLVZlZSiju16pGUbETEUNuTxgpXWFBhRvCKPFyAQ:LudTNcDGXuYVEQUk2+1C+FyAQ
Malware Config
Signatures
-
Detect Neshta payload 10 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 9 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\officedeploymenttool_11509-33604.exe"C:\Users\Admin\AppData\Local\Temp\officedeploymenttool_11509-33604.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\officedeploymenttool_11509-33604.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\officedeploymenttool_11509-33604.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\setup.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\setup.exeC:\Users\Admin\setup.exe2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\setup.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\setup.exeC:\Users\Admin\setup.exe2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\setup.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\setup.exeC:\Users\Admin\setup.exe2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\setup.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\setup.exeC:\Users\Admin\setup.exe2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53b73078a714bf61d1c19ebc3afc0e454
SHA19abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA51275959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
-
Filesize
362KB
MD5b0cf4d4211af8f0b07acf093873de57c
SHA1eda7231eb3cdaebb177474c01e5fff32578f9bb3
SHA2564ab410ceb7b0b085d9097a17cbc56ada1c3760a534f7c95a0e016e81c8cb4bac
SHA5123cb103a1ce7c05efb458b5e0ea8504307b63a0fb48e25125fe2ef29538d73692e2f8ba6d16571fdba7f9afd044feff823ec91d2f8ab338cfdb002094a0e25566
-
Filesize
1.6MB
MD53a3a71a5df2d162555fcda9bc0993d74
SHA195c7400f85325eba9b0a92abd80ea64b76917a1a
SHA2560a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
SHA5129ad76ccce76ccfe8292bca8def5bc7255e7ea0ba6d92130c4350da49a3d7faef2d46b08aaef1955f3f4ea0a2e22451562b5e08783a79f794724584e409cf7837
-
Filesize
2.7MB
MD5224301a7acd031d508619e40a1b92775
SHA18b3b09172e3d01ea8205abb14772d8e6aa36bdfa
SHA256450f28e924cfe1931883ee7de2ea7252d0e03b770742258d4d9ced43718c3897
SHA51298593d16c23918d68d994cc179627da06ac0b3f33d3d4b1f6965160c86a7ea0de68d0de850cf94181b7a3737eb6233c5230ccb35254fc45171c894482fcc6809
-
Filesize
8B
MD5698f2d72057bb4fec5a884793edf2fc0
SHA1052f17b9812911ff086c78f6e09b9cc578c0a056
SHA2569903df9ea283d9834ab2d5050acdbf02336119ecf7038d04035a0416de9d5410
SHA512e0669fc702ce22d3ddc1f33f3c9154a4e511bb94604e8a51cea5dec25d7cdbf9c5c68b9b884c3bad83da3f5e2bffa31111a635247d86ca495fa0b87d686eb15e
-
Filesize
5.1MB
MD577386ead6f9d2bcbaa9aa0517c3e65a5
SHA12b8af13fc4dc48f70f66e04abf5b25d74ffce15a
SHA25691e00cda173a891cad35a45420ad7dd5557076e61ebf4444874dec541093009a
SHA512324b5d1e652a2fba65cf5e62c4b8d7669206143849dacd639fec9871c8c1106b816b436d5517064d4ffc6aef97dbd2ad9e8493d16e513f04bf190e27230e98b8
-
Filesize
26B
MD509e047b9e64c494830429d91b45d14d3
SHA116f7645748f87dcdf34f8b421e8f52ce6848f322
SHA256a3711c8f5e1328003f806a8854defe07806a3471a51f6ac81fb023a031b7b139
SHA512177f07ceac69d65bc51255391ee57fbf132be5cf54c2effd2646b73dfcc7f2dcc68882fb029761951fa3ebf8829113b0e9256bce9bb90796188585f009c7b2d3
-
Filesize
40KB
MD555c7565bd1c02cbd56074d925acbf021
SHA135ff6d345b849a501d6afa6bc63aee1b765cfd4d
SHA256e1f0ef2922d3e2b1a3205560b4fe40a2f1d97a894badb669625d675ea3ce22a4
SHA512e20af4b363d180f03320501c06b03845e9dfd6b8037e5bc5b3430362543662e5e0a2f13fc277c3973d1d1326ea56959b95cb45685596486bf69d9d0fda951390
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB