Overview

overview

10

Static

static

3

2025-04-15...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    107s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2025, 04:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe

  • Size

    325KB

  • MD5

    82a0d12067c1fe7aaf29a3607a7ad996

  • SHA1

    daa39958c5aab26f407d87a448f9839c904ca1c8

  • SHA256

    56d817b273baaf841a4cff20c987139bffd9a1bf65616e5cd6e7ebafed897322

  • SHA512

    80678d18be3afc705fe176e990328e359a202259e4c9ef4ef1379db2138837d7ddaf58baa3324ef57f650f4cbf1ed4b0c0f15e35933feb8ae20b7d1974784f33

  • SSDEEP

    6144:79MobN5zFEjGkqkAJHyECYVO+vVhWPZw22b:aozzFEoSLt+vVhiZwbb

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe"
      2⤵
      • Executes dropped EXE
      PID:3568

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
    Filesize

    86KB

    MD5

    7ef3b7d5bc93a7c86e85bbbd49742d90

    SHA1

    85a8a05b310ac35872502727d6fccdbd68ae34a6

    SHA256

    ae9c220c6c1635d59aa7d7a346d9f26301c34b642e23290a2fd37ff5577a9ed6

    SHA512

    9f8d7e16eab91f5544439bbac1ed08aa66adf42e34bc0fe1ad9c9ec010c4e20dc5f2c3c752cd4612440170f70bc03d4a1430e8bd297b2abb6b2203ddd63452fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-15_82a0d12067c1fe7aaf29a3607a7ad996_black-basta_cobalt-strike_elex_hijackloader_neshta.exe
    Filesize

    285KB

    MD5

    1562e15220d8771fcb11b9a5b234a970

    SHA1

    50ec8e4e7125bda147a1b2ccc2b2827db2dc3479

    SHA256

    366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f

    SHA512

    a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f

    Download Submit

  • memory/1968-146-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1968-147-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1968-149-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3568-13-0x0000019BB36E0000-0x0000019BB3950000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/3568-23-0x0000019BB1DF0000-0x0000019BB1DF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3568-24-0x0000019BB36E0000-0x0000019BB3950000-memory.dmp

    Filesize

    2.4MB

    Download