Overview

overview

10

Static

static

3

2025-04-15...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2025, 04:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe

  • Size

    262KB

  • MD5

    233ff4ceb7d97202d1e841895dd9d53b

  • SHA1

    e8777632041dd0e09ccdf2a94d68a523e7003306

  • SHA256

    1888ac2b2adccc3cb3c53b139123b4620a56d3ad31b11ed8e8543532087fab04

  • SHA512

    cf23689096f91fb024d16702eeb61ec0b10b4442e0d1d2a1af682c11793297ed0653b132a1efb9f387b55fe27d69bc8f8358b21d3a993f0669a21f3923d82adc

  • SSDEEP

    6144:79FWE7bqZpcbrPD4RZcM1SwMd7wvcFu/B5/:GE7V/L4RqYSwM+p/B5/

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2356

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
    Filesize

    86KB

    MD5

    7ef3b7d5bc93a7c86e85bbbd49742d90

    SHA1

    85a8a05b310ac35872502727d6fccdbd68ae34a6

    SHA256

    ae9c220c6c1635d59aa7d7a346d9f26301c34b642e23290a2fd37ff5577a9ed6

    SHA512

    9f8d7e16eab91f5544439bbac1ed08aa66adf42e34bc0fe1ad9c9ec010c4e20dc5f2c3c752cd4612440170f70bc03d4a1430e8bd297b2abb6b2203ddd63452fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_233ff4ceb7d97202d1e841895dd9d53b_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_neshta.exe
    Filesize

    222KB

    MD5

    f925a5c64ce7fd8e01e3ad6572d21406

    SHA1

    379b7fa83587e09234146a551d22b9bb4016a17e

    SHA256

    8b99ab537d3f709bc5b9331eafd9e3cfc4a3107771db6fb008a0f9dbefe3debc

    SHA512

    a39c611334d133f64c7de6c6cf89fd2ec0aba4be07da90c8dd9b7c849c6d3a3810f20f03a0b71017294a93f36e1b5ab97c189f20df2e6f6ec74b115bf2e902ab

    Download Submit

  • memory/1536-132-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1536-133-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1536-135-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download