Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-02-2025 17:22
General
-
Target
2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe
-
Size
3.8MB
-
MD5
0fa8d67b7b0dcdb853e4d623fc961d4c
-
SHA1
5fe09bcc7c94fe22b3df959c89d80b61c69431c8
-
SHA256
069e5741562c5058aa9ccc58b47050fada4b5738ab08f42eada6d1caf75f20b0
-
SHA512
3a80d1d8af2cf12162f4102d500083b5597b72a2fe49699987e320a085560349854bbe087f3b3fdec4b61daec0a477386ec4644556cc4c09802ac3b9877b4ae8
-
SSDEEP
24576:icVmmyK+Y8J0r1dpvZlGhiUTPQOMoezwFnKS1yb0zrs7HjeAzgeJENrud9qcjL1r:icV8Ytr1dhrwierOjeAzAruTqQt02+k
Malware Config
Signatures
-
Detect Neshta payload 6 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
-
Zebrocy Go Variant 1 IoCs
-
Zebrocy family
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
186KB
MD5888cfa13e7838126a422b307b53d8f3c
SHA1fe690b2dc691c3a6f2caf1d624e88336957fa8f2
SHA256b661ba8cdc8a84394236b7925ba5e1465350ae1bb953c4af0acbe9d1010e19c5
SHA51286e736ab9f0c88ddb07ad5c13db1dff2d2a3465e4491feceaae07fefb9a986379f113dc04109317e2c8aef47f780e35f7238da2b6e0df746691c0eb9b44f2d96
-
Filesize
1.1MB
MD5566ed4f62fdc96f175afedd811fa0370
SHA1d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
-
Filesize
859KB
MD502ee6a3424782531461fb2f10713d3c1
SHA1b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA5126c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
-
Filesize
548KB
MD5c453c2e9903a3e041b0ce874efd1ba67
SHA1802a5bf3f9e92c92ce70a6dfbecafe333f92f84f
SHA256a6ab0ce31c8f1e8bd82360a3aea1bdfa4a657fb95d1f4a1f63a1c017f4386685
SHA51299779fbc6c620477212529e6c9e2d3c3b24f1acea61834e11cd8d133524713116734988666a9e44c8f56171efe4c239bf64a8a39de91361f9375cd4fa16dfdf0
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
3.7MB
MD5d659325ea3491708820a2beffe9362b8
SHA16e7f725401c33332beb2383a6802a7e4b2db30a9
SHA25609133f97793186542546f439e518554a5bb17117689c83bc3978cc532ae2f138
SHA512958f4a72530703131be2f25dc906ab7fc8ee174e9cbd13f9c976af7e986593b56a768e0413e6a85d06f2bdc057ac7d9617f6c25cbf8f13cc2f8348bcf441eeb5
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB