Analysis
- max time kernel
103s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system - submitted
12/04/2025, 06:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Profoma Invoice.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target Profoma Invoice.exe
- Size 737KB
- Sample250412-g29msayp14
- SHA256 a9d818bc38d2a84ff40e54a062a9fba01a0648300fb1a892432547bc5b85e158
- MD5 a7b0a2d31c9d230e5cd425ef80a7c126
- SHA1 f2036f08234228181c1fc5de37eb96ce2d3d521a
- SHA512 70859e8be68ead1eb4f63f6e5705a80c18744f98f71f2662df68e16281c3353437e8224fea7f9d52ed794c3b804fea7c2f1e081615afda661fea45ba66068e84
- SSDEEP 12288:eIiKV/9THVDUzYl7LRNbd7tA/ZI/8p6Rh1lVaE4W3OrrfCZxeF/IT4xy811lmyD+:eYbLRNbc/ZIUqh1Dl4W3SbgxeJG4x71c
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 6 IoCs
resource yara_rule behavioral1/memory/1008-11-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-12-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-13-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation Profoma Invoice.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Profoma Invoice.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5172 set thread context of 1008 5172 Profoma Invoice.exe 98 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\BHO\ie_to_edge_stub.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.43\MI9C33~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Google\GOOGLE~1\134069~1.0\DISABL~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\msedge_pwa_launcher.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.43\MICROS~3.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\elevation_service.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.43\MICROS~2.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\msedgewebview2.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.43\MI391D~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\cookie_exporter.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.43\MICROS~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\elevated_tracing_service.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\identity_helper.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\INSTAL~1\setup.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\133030~1.69\msedge.exe Profoma Invoice.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Profoma Invoice.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Profoma Invoice.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Profoma Invoice.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Profoma Invoice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Profoma Invoice.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Profoma Invoice.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98 PID 5172 wrote to memory of 1008 5172 Profoma Invoice.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\Profoma Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Profoma Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\Profoma Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Profoma Invoice.exe"2⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1008
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 d0795aba4048459a2e8aa9af721c8ed0a5daa672314cb2970a73e5cc34e771de
- MD5 6bed9d5df4ae9457b5f131db5da335a6
- SHA1 a8dc5e1f9e7f9a17184c066a72adaa6b552525f1
- SHA512 ffe40d95d3dc296c1cdd44691fad67aa4dc07f3aa8dd2c6c55dd27cff4e76155bafcbcff877b11cebd19381800f645131e514b1f7e8bfff7c8f626865de73457
- SSDEEP 1536:DLPO6E+ciU23i0kyM4OWEg1Pgh/sE/EkHd0Ci2zkQASqk+H6L2C:DL1BU23ipyM4TEg1ksEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\Profoma Invoice.exe
- Size 697KB
- SHA256 3ce34b0d77238064b9d5ec2dd143ab5d186c14f6c726d86a4f31e8590bbc3ad2
- MD5 babb503e077492186ca2789d5355cb6c
- SHA1 4096090173fe7690fb69e98eba2140c6b0731004
- SHA512 00229efab1e2e5c5cc724b7511df788ce4ad489184e17c1698b5e00d4aa420d8081b640e2eeeb121b51959eb13eed73bee5f04c96e1fc1e4b782d45f37762a2d
- SSDEEP 12288:pDab+fFIJiKV/9THVDUzYl7LRNbd7tA/ZI/8p6Rh1lVaE4W3OrrfCZxeF/IT4xyF:tQgItbLRNbc/ZIUqh1Dl4W3SbgxeJG46
- MD5 SHA1 SHA512 SSDEEP