Overview

overview

10

Static

static

10

2025-02-15...ta.exe

windows7-x64

10

2025-02-15...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    15-02-2025 04:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe

  • Size

    186KB

  • MD5

    a7e14726f03b31c182626f457295f00c

  • SHA1

    40f94283483712abfca017b4ea4c0785618a4c27

  • SHA256

    8b37a0ceaa72fe854f73150f0a9d7e64469e9d5cc6a85c2fb88527c65997d15d

  • SHA512

    85e6bab0cbf6b4c018a87eefa6e0a2c6683ca9b6313b3ab1b69f231d5f6cc59bca99a2285aecb68b479001c8c605c7bdfdd9cb712b3aae2aab87eb42b5787c80

  • SSDEEP

    1536:JxqjQ+P04wsmJCVvMH+1zGSNAojMP95D1xDmNgwg0XiOiu/8EINw5YkjPGHUyzS7:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYg

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 3 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2200

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\AAAAAAAAAAA
      Filesize

      129B

      MD5

      7b8f8eddadeba95223a220a2f353f5b6

      SHA1

      1f9502805be7785d8e4b11ae3d4da41c13ac54f1

      SHA256

      96b71c6271a54395ea7d1f376c9b5bbc675e65d39c35cc39e2ac65809496e6d6

      SHA512

      0f1dc965dfd6ed7e1943ced595a91db9569ff0edd20ea76c55504acf1a55eb161bb710063f383ee7aba310a63c08beee500728562bb648d58aa580f00a5d63f1

      Download Submit

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
      Filesize

      145KB

      MD5

      1d073f93fb5d03cf4a956ef84ea5f421

      SHA1

      64c6f72e368f74479b90cf7b24e9e3ec1d5e9940

      SHA256

      13d72d8ee7cdd0d2e343b6dc08b957c9796d411062c6be9d864bded9d7e4c9e1

      SHA512

      a454402d654b05d1cb866cdf836ad137396c777e11c590542d69e1e69ff5fb8f728c4ebdc77a5600369731ea440f28d8b25320190b27c34637d73c69a15397fe

      Download Submit

    • C:\dfsQPArFx.README.txt
      Filesize

      423B

      MD5

      92884787e7c169d8663698e659aff38b

      SHA1

      073e33ff3228f76577a04bad58e2669b694f5506

      SHA256

      173845d8676314c655a1199c376b10910cf5cbcdb79f5eb2ac08564a5a44c5d2

      SHA512

      76afd421468412cad142d5389d7eb7eb55412aff0338c288966a54bca1e37d3552248e65c0514b4730a4175422e74ccce43e223fada251a1d35421857cbfc37f

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      a4c910ea4eabf442334e5b875e0aeaac

      SHA1

      8d1e35ed3f5d5f12df0cc5108d4687fb38d92060

      SHA256

      465745ce50526feb15f4560afb6351e9b4ebb5dcdbd0eb36a6070046bb11fd76

      SHA512

      ccaab33af66d16b6c0dc1069ad0186cda468e9ad12bebcafd48c90f849b9e9aebad3547e7fd455e895d98092e4ecc390eed7f46c654b2a4cbb5eecb836b6c89d

      Download Submit

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

      Download Submit

    • memory/3036-934-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3036-936-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3064-14-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

      Filesize

      256KB

      Download