neshta | 6a051afc95e34431e4abbe7d4a4de66f07c80ea2dc42cbe5e5816ea3da6eaee6

Analysis

max time kernel
127s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dangerous RAT/Dangerous RAT.exe
Size

7.2MB
MD5

302cb7218c3275c139ac070dae4f4daa
SHA1

bcf24a42ae53f36863caa8b9c49a67d6a2bbc223
SHA256

0079ba87b80bba1dbeb2fb1ea7361f7a44d0c4e9d55995c28b3329e9265a8c14
SHA512

118819ac3011e0cb6222e883c95d179a970b8166dccdff7ed3bdeb34d1f67a5eee1ef2b251d708fd67b07835eb67cdbfcf877bb722f35a4dd086e38bf98c8adb
SSDEEP

196608:/btBPRnfvon6IZYhydLLCdsflb8MKHTdas:7ZQ60LyS8MSas

Score

10^/10

neshta xworm discovery persistence rat spyware trojan

Malware Config

Extracted

Family

xworm

Version

3.0

3skr.uncofig.com:9999

Mutex

wRjQMjeNtaZnUCMU

Attributes

Install_directory
%AppData%
install_file
USB.exe
telegram
https://api.telegram.org/bot7942324376:AAFz5Z-GdKIj1CePZyqIUmvNWOymMRw8Lmk/sendMessage?chat_id=2078478344

aes.plain

Signatures

Detect Neshta payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b96-21.dat	family_neshta
behavioral2/memory/2504-32-0x0000000000130000-0x0000000000C6E000-memory.dmp	family_neshta

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b94-7.dat	family_xworm
behavioral2/memory/2624-16-0x00000000003B0000-0x00000000003C0000-memory.dmp	family_xworm

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation	Dangerous RAT.exe

Executes dropped EXE 2 IoCs

pid	Process
2624	set.exe
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dangerous RAT 2020 Cracked by Unknown Venom.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	set.exe
Token: SeDebugPrivilege	2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe
Token: 33	2660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2660	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe
2504	Dangerous RAT 2020 Cracked by Unknown Venom.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2624	2896	Dangerous RAT.exe	90
PID 2896 wrote to memory of 2624	2896	Dangerous RAT.exe	90
PID 2896 wrote to memory of 2504	2896	Dangerous RAT.exe	91
PID 2896 wrote to memory of 2504	2896	Dangerous RAT.exe	91
PID 2896 wrote to memory of 2504	2896	Dangerous RAT.exe	91

C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\Dangerous RAT.exe
"C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\Dangerous RAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\set.exe
  "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\set.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\Dangerous RAT 2020 Cracked by Unknown Venom.exe
  "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\Dangerous RAT 2020 Cracked by Unknown Venom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x420 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\Dangerous RAT 2020 Cracked by Unknown Venom.exe

Filesize
11.2MB

MD5
fb40ba1b494af4057ab259bba5f33fe6

SHA1
b872393a07d3949947a41871132b736c00c771bb

SHA256
40a82c50b9875698551a2f6dd4f71fc23b4a04eeec655a4746111279ef57d2ac

SHA512
f2feec8be6578aa273efd363ae1eba0862fc240a441fd8d1f14942fda241e34896e7b76179d7132af97f18acdf13afd4032f1874a9b20cc04120706beff9e804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dangerous RAT\set.exe

Filesize
38KB

MD5
e1929d0781ff08abf8be3051479043b6

SHA1
0605a5657e022bd1cadf80f13446c678728dcde9

SHA256
b4ae6a462c5f24bec5870f6e92d94a00b1e1a4abd95e5433d6ac99a0f9d92042

SHA512
fb47c341b636293d500f1892f02e2be2b16bd0301eedc0c30025c00ae22ce3fe6d42abc0a4837cc5551eeed6cd5bbe815a0301db86bac6a84177a6c103d54d27

Download Submit
memory/2504-38-0x00000000077E0000-0x00000000077EA000-memory.dmp

Filesize
40KB

Download
memory/2504-32-0x0000000000130000-0x0000000000C6E000-memory.dmp

Filesize
11.2MB

Download
memory/2504-36-0x00000000058A0000-0x00000000058F2000-memory.dmp

Filesize
328KB

Download
memory/2504-35-0x00000000057A0000-0x000000000583C000-memory.dmp

Filesize
624KB

Download
memory/2504-42-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/2504-41-0x0000000002FE0000-0x0000000002FF2000-memory.dmp

Filesize
72KB

Download
memory/2504-31-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/2504-39-0x00000000079F0000-0x0000000007A46000-memory.dmp

Filesize
344KB

Download
memory/2504-34-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/2504-33-0x0000000005B50000-0x00000000060F4000-memory.dmp

Filesize
5.6MB

Download
memory/2624-15-0x00007FFAA1C10000-0x00007FFAA26D1000-memory.dmp

Filesize
10.8MB

Download
memory/2624-16-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/2624-37-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

Filesize
64KB

Download
memory/2624-40-0x00007FFAA1C10000-0x00007FFAA26D1000-memory.dmp

Filesize
10.8MB

Download
memory/2896-30-0x00007FFAA1C10000-0x00007FFAA26D1000-memory.dmp

Filesize
10.8MB

Download
memory/2896-0-0x00007FFAA1C13000-0x00007FFAA1C15000-memory.dmp

Filesize
8KB

Download
memory/2896-4-0x00007FFAA1C10000-0x00007FFAA26D1000-memory.dmp

Filesize
10.8MB

Download
memory/2896-1-0x0000000000CB0000-0x00000000013F2000-memory.dmp

Filesize
7.3MB

Download