Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2025 21:56
Behavioral task
behavioral1
Sample
41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe
Resource
win10v2004-20241007-en
General
-
Target
41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe
-
Size
345KB
-
MD5
d0bc624abb5acafb637fb8777981f96d
-
SHA1
32371b6a4f8ed0f3902d80b8ecbeb45cb691b5e8
-
SHA256
41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f
-
SHA512
c908dcaf037b7a286afcfd9765e39e80976f142de44675da2b33b57d2e41c9f33c2f2defe476cbbecd13d402cce220a9fae87dc4af7204600db7a408f4c43bcb
-
SSDEEP
3072:sr85CpfkJKzvJJT5YOFt6WAvglqAXE+G17OWamvW8Idn/oY462wd2V39SGP2mzTt:k9l73TqOFt6WAvIqAYOWUPohnCGeVeb
Malware Config
Signatures
-
Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x000600000002023a-13.dat family_neshta behavioral2/memory/2472-93-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2472-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2472-96-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 3992 netsh.exe 2952 netsh.exe 5092 netsh.exe 2548 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Executes dropped EXE 2 IoCs
pid Process 3608 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 4284 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2472 wrote to memory of 3608 2472 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 82 PID 2472 wrote to memory of 3608 2472 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 82 PID 3608 wrote to memory of 2540 3608 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 85 PID 3608 wrote to memory of 2540 3608 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 85 PID 4284 wrote to memory of 3928 4284 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 86 PID 4284 wrote to memory of 3928 4284 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 86 PID 2540 wrote to memory of 5092 2540 cmd.exe 89 PID 2540 wrote to memory of 5092 2540 cmd.exe 89 PID 3928 wrote to memory of 2548 3928 cmd.exe 90 PID 3928 wrote to memory of 2548 3928 cmd.exe 90 PID 4284 wrote to memory of 2600 4284 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 91 PID 4284 wrote to memory of 2600 4284 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 91 PID 2600 wrote to memory of 3992 2600 cmd.exe 93 PID 2600 wrote to memory of 3992 2600 cmd.exe 93 PID 3608 wrote to memory of 3296 3608 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 94 PID 3608 wrote to memory of 3296 3608 41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe 94 PID 3296 wrote to memory of 2952 3296 cmd.exe 96 PID 3296 wrote to memory of 2952 3296 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe"C:\Users\Admin\AppData\Local\Temp\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Allow SOCKS5 Inbound" dir=in action=allow protocol=TCP localport=421003⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Allow SOCKS5 Inbound" dir=in action=allow protocol=TCP localport=421004⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Allow SOCKS5 Outbound" dir=out action=allow protocol=TCP localport=421003⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Allow SOCKS5 Outbound" dir=out action=allow protocol=TCP localport=421004⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exeC:\Users\Admin\AppData\Local\Temp\3582-490\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Allow SOCKS5 Inbound" dir=in action=allow protocol=TCP localport=421002⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Allow SOCKS5 Inbound" dir=in action=allow protocol=TCP localport=421003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Allow SOCKS5 Outbound" dir=out action=allow protocol=TCP localport=421002⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Allow SOCKS5 Outbound" dir=out action=allow protocol=TCP localport=421003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3992
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53b73078a714bf61d1c19ebc3afc0e454
SHA19abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA51275959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
-
C:\Users\Admin\AppData\Local\Temp\3582-490\41bf39a9b64fbc8f6b9c79f911561ebdcb8c491002597143e5fcc0484f98827f.exe
Filesize305KB
MD52337a3984a119f08d630fd6302a4d7ba
SHA1d281bfd2ae79131d90c1599c446a4b0d666ee863
SHA256a988cc764b5db0c63c8c6fa5983015993d0e336111c06376325376c1f89de84c
SHA512cafa2e6d2fae537eb39f95863275ed818c6dada779bb60934f15164a7afe383d45a165dd82eff1aa6c720ed4f70ac47a9105ce572af5f775d9b9b11fc04f37b8