Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07/02/2025, 18:03
General
-
Target
2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe
-
Size
3.8MB
-
MD5
0fa8d67b7b0dcdb853e4d623fc961d4c
-
SHA1
5fe09bcc7c94fe22b3df959c89d80b61c69431c8
-
SHA256
069e5741562c5058aa9ccc58b47050fada4b5738ab08f42eada6d1caf75f20b0
-
SHA512
3a80d1d8af2cf12162f4102d500083b5597b72a2fe49699987e320a085560349854bbe087f3b3fdec4b61daec0a477386ec4644556cc4c09802ac3b9877b4ae8
-
SSDEEP
24576:icVmmyK+Y8J0r1dpvZlGhiUTPQOMoezwFnKS1yb0zrs7HjeAzgeJENrud9qcjL1r:icV8Ytr1dhrwierOjeAzAruTqQt02+k
Malware Config
Signatures
-
Detect Neshta payload 7 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
-
Zebrocy Go Variant 1 IoCs
-
Zebrocy family
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-07_0fa8d67b7b0dcdb853e4d623fc961d4c_neshta_snake.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
186KB
MD53f5d8951e72f04e5694bdcba22482cf2
SHA1943908aed6bf51f93472d818237e6b0b53fa287a
SHA256b718e4e0ab3bcc3f1ff994cbab53aefa7a60bfb819256f348d15a09540fe5e2f
SHA51257ca4d3f96e6a3470a2c0448a778ea1911dd518115b9361be80279199d337fa3c41fb7863bb985822191a47e710a374aca512ea1b42ae3b66ce950aa7f43bad5
-
Filesize
1.1MB
MD53ce525706e9f71d68f397bbc812f88c4
SHA129f02473e7d44e8581cc704b0a273cf029cbdb11
SHA25639d4ce627eea6fb0be5be19c102c8ee38a10eb4ba87daa4ef8c7518a045cca3c
SHA512a750b0aca7f37f152a2613fd6039248e6cbcef0397849754000ec5aaec28aad5d45c92c018c70d64fe369a31144264d3e5fe8236dc7a6429e4bd4d0dc7f5e04d
-
Filesize
859KB
MD5ac8c80cfdf9590d6ba60d34b9f8c5324
SHA123ae5fe1b44f3c2e5be116d8c8f0f7f7eeb1ad17
SHA256f0c41235cdea38190f245252c406cf69e4c3d6ca8083bd0abe9da2ef5158bddb
SHA512ee30a4c594d1deeceac70053830f41b9ff4be7a91396154cb9d443df2bc587c3c5d4c97e54b9f64834ce098f7b7dcbdeb7ec73655da773517a09fd88a6c519f3
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
3.7MB
MD5d659325ea3491708820a2beffe9362b8
SHA16e7f725401c33332beb2383a6802a7e4b2db30a9
SHA25609133f97793186542546f439e518554a5bb17117689c83bc3978cc532ae2f138
SHA512958f4a72530703131be2f25dc906ab7fc8ee174e9cbd13f9c976af7e986593b56a768e0413e6a85d06f2bdc057ac7d9617f6c25cbf8f13cc2f8348bcf441eeb5
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB