Overview

overview

10

Static

static

10

2025-02-15...ta.exe

windows7-x64

10

2025-02-15...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-02-2025 04:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe

  • Size

    186KB

  • MD5

    a7e14726f03b31c182626f457295f00c

  • SHA1

    40f94283483712abfca017b4ea4c0785618a4c27

  • SHA256

    8b37a0ceaa72fe854f73150f0a9d7e64469e9d5cc6a85c2fb88527c65997d15d

  • SHA512

    85e6bab0cbf6b4c018a87eefa6e0a2c6683ca9b6313b3ab1b69f231d5f6cc59bca99a2285aecb68b479001c8c605c7bdfdd9cb712b3aae2aab87eb42b5787c80

  • SSDEEP

    1536:JxqjQ+P04wsmJCVvMH+1zGSNAojMP95D1xDmNgwg0XiOiu/8EINw5YkjPGHUyzS7:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYg

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 3 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x148
    1⤵
      PID:1588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini
      Filesize

      129B

      MD5

      4ab5e4e184e8ac1af32f2d325c685900

      SHA1

      7b107d6a44c27393fe60f1e3617e595327a1627a

      SHA256

      edf970a3b82df79ca9e416796d29cc17732c24fa955dbd69e9251c196e1db3d7

      SHA512

      11707c79f119452e8f2ce6b988dd6870e4a9ba8effd583d1182fecbeef3dd42e347ea3eb3f0f7e698fed89a53e15fe1663c96b3f3a0ae51a68ab2b82df634592

      Download Submit

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

      Download Submit

    • C:\dfsQPArFx.README.txt
      Filesize

      423B

      MD5

      423532e7574741ede87679b17fbc0697

      SHA1

      8a2984928213caa9591be0c1806175c0f07fa4ab

      SHA256

      f79f892d26ebdeadad67e848fd0fee6161106d5dea853158f8750ce54168076f

      SHA512

      475d4477f8151c82bf9bf44ee670f6f0ca176d5cf7a4a106a6050dc893551adeca630c4ae046e1d87509dda6ad3a291ff624fc95949f0ff76ea8c3834d4947fa

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-1846800975-3917212583-2893086201-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      910b859ba98680c387e42a8f1e4f0f71

      SHA1

      486eb10df8eb0b5ad7731a4b9f03503ad919e6a4

      SHA256

      350e4ad6063dcb78373073b83bf638ffd064f1cb4fbbf4073d4949db2efb259c

      SHA512

      1328e08d863c385818781cb2667ae0e7cb3f2553b03edc210a87806790212fcc349d7969a72f2dbef74ecc5d6f47000201f7202633b92dd8132a9371ae3f63a3

      Download Submit

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

      Download Submit

    • \Users\Admin\AppData\Local\Temp\3582-490\2025-02-15_a7e14726f03b31c182626f457295f00c_darkside_neshta.exe
      Filesize

      145KB

      MD5

      1d073f93fb5d03cf4a956ef84ea5f421

      SHA1

      64c6f72e368f74479b90cf7b24e9e3ec1d5e9940

      SHA256

      13d72d8ee7cdd0d2e343b6dc08b957c9796d411062c6be9d864bded9d7e4c9e1

      SHA512

      a454402d654b05d1cb866cdf836ad137396c777e11c590542d69e1e69ff5fb8f728c4ebdc77a5600369731ea440f28d8b25320190b27c34637d73c69a15397fe

      Download Submit

    • memory/2800-930-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2800-932-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2824-14-0x0000000000910000-0x0000000000950000-memory.dmp

      Filesize

      256KB

      Download