Overview

overview

10

Static

static

10

2025-02-15...ta.exe

windows7-x64

10

2025-02-15...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2025 04:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe

  • Size

    186KB

  • MD5

    a7e14726f03b31c182626f457295f00c

  • SHA1

    40f94283483712abfca017b4ea4c0785618a4c27

  • SHA256

    8b37a0ceaa72fe854f73150f0a9d7e64469e9d5cc6a85c2fb88527c65997d15d

  • SHA512

    85e6bab0cbf6b4c018a87eefa6e0a2c6683ca9b6313b3ab1b69f231d5f6cc59bca99a2285aecb68b479001c8c605c7bdfdd9cb712b3aae2aab87eb42b5787c80

  • SSDEEP

    1536:JxqjQ+P04wsmJCVvMH+1zGSNAojMP95D1xDmNgwg0XiOiu/8EINw5YkjPGHUyzS7:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYg

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1864
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0M2MDFBRkQtNzVGMi00MEQ2LUEzQUUtMTNFQjg3NkYwREY2fSIgdXNlcmlkPSJ7NjQ3OTFCMTYtQzQ1QS00RTRFLUIzQjgtQzcyOEIyMkVBQ0NGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTNEQjZDRTAtRDQ2QS00MUUzLTgwQTgtOUNENzI0ODE4NDhEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODU5MjkzOTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2656314083-4170277356-267438488-1000\desktop.ini
    Filesize

    129B

    MD5

    368da2bd0bef10536a51d6f2c4ccb8f5

    SHA1

    f70d59fc84a89ab45b21758656da566a2229233b

    SHA256

    96d14776bd4535f96fa57d3544fcd4d5fe19d6de0ad9b89a4caff0310ece7cc1

    SHA512

    f3c0c5515269d555e7e0fc19332b33216fd1cae575acc31195802c6911bd0b214f586f97fb37ace9af6bdbae6b29d08f564fd0fb173995130ddbc4669663b1bb

    Download Submit

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
    Filesize

    145KB

    MD5

    1d073f93fb5d03cf4a956ef84ea5f421

    SHA1

    64c6f72e368f74479b90cf7b24e9e3ec1d5e9940

    SHA256

    13d72d8ee7cdd0d2e343b6dc08b957c9796d411062c6be9d864bded9d7e4c9e1

    SHA512

    a454402d654b05d1cb866cdf836ad137396c777e11c590542d69e1e69ff5fb8f728c4ebdc77a5600369731ea440f28d8b25320190b27c34637d73c69a15397fe

    Download Submit

  • C:\dfsQPArFx.README.txt
    Filesize

    423B

    MD5

    4d7455f8b5a92a45738f12b0a0b361ef

    SHA1

    0c6c9a6f6a6e15fd3a4a9b45897f5469460bb5cb

    SHA256

    d287a11f5cf5df64970de65bea9a0d722959e0c524a1557975d2ae532ec9ffab

    SHA512

    51eda9af839dbbb7cab365acecb3e1bb7c17d1f5b1c81b70fc69ee4fb305c30e1c8ad67d9df77807bda5ac7d8a88154e84be84f7825bb8d00f603e5284d48d87

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-2656314083-4170277356-267438488-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    e3f035c847667db7e9c42c36214763a8

    SHA1

    f52f0c5303ae9a89d8f9fe08819a7c2933873bc2

    SHA256

    cce3f5f877f740f3c3fc599b6a3be4ae50747e1637143e3078f1c562f5feec99

    SHA512

    50fe8391fa921bf883d4cfd43ffb7baf34d1b6f6d794952e0d711b943d3849b8fee6f4d7d49966e80370c72536fcd3e5de2fc5c84d4f0ac8774e15af5405900d

    Download Submit

  • memory/1864-11-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-10-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-9-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-2851-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-2850-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-2849-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2848-2852-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2848-2853-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2848-2855-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download