neshta | be038d646731b781a366e9a367bceeb2ff97e841dc92d276d559c0d0bde04b55

Analysis

max time kernel
103s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe
Size 1.1MB
Sample250418-n35tjsvls2
SHA256 be038d646731b781a366e9a367bceeb2ff97e841dc92d276d559c0d0bde04b55
MD5 fb87010be51312eb71cc810a5e3d97c5
SHA1 00366bf0acbfe2ece51f033fea5ba11a2f468ce2
SHA512 5e4ae100fa06b632c8418aa7594cd8189fc084052b319f7d6b4a9c96b602374537777799e244246aa94049140a59877a57f943b8cdd8405425a57ca2ed952612
SSDEEP 24576:poYSPFmIEQBzd104zi7jTc5wsxbtUdHZvKzNexqIP2ru85t:pdSBzn0O6jTGbtUdtKzNexqIP25
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta discovery persistence spyware

Malware Config

Signatures

Detect Neshta payload 3 IoCs

resource	yara_rule
behavioral2/memory/4060-1354-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4060-1488-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4060-1490-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ChannelUris.vbs	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\cookie_exporter.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\BHO\ie_to_edge_stub.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\elevated_tracing_service.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MICROS~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MI391D~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MICROS~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\INSTAL~1\setup.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\notification_click_helper.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MI9C33~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedgewebview2.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedge.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\elevation_service.exe	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MIA062~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE	InstallUtil.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MICROS~3.EXE	InstallUtil.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	InstallUtil.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe
Token: SeDebugPrivilege	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78
PID 3464 wrote to memory of 4060	3464	SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29716.22536.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ed86abf6d013bca2be968bd470bda927d98fce3b988d5e299f47d29e4da45ee4
MD5 448f09608ad2bc10f12379e2f66e72e6
SHA1 741fc911241da01389c1466da5c2fed7bb7f9473
SHA512 5784b8bd1900043258d53d1c1d02855681011a2a2eb68c7c0ccca02701099ede6feb003553888e53fe99037fd9aaa31ce445a9889ccfe349a87f9ae2a0590ccd
SSDEEP 1536:GMhSqd/S3shbEuvgh/sE/EkHd0Ci2zkQASqk+H6L2C:bhfd/eshI1sEM6GC+QA8+HlC
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\InstallUtil.exe
Size 40KB
SHA256 80b65a2da656bb613d95cfe83fb53f17a60ea0435c2e5f4b5a7831e62d126dab
MD5 2a94238e97654f9d9706a383244ad8c7
SHA1 dda05626344a4c304f06049fc5f607e05085efbc
SHA512 8f3747996ad48712206d5f73027cb10150f814a0c85d910341ae4ac9bc6a132c8ccb37015257ad8295f911adebc30c1ec0f9f04da2f527f54c993189c585af05
SSDEEP 384:LqImrpZFhLK0MsihB9VKS7xdg8YKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+h:L2ZJMs2Sqd/b6Iq8HOshcWEu4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CHANNE~1.EXE

Path C:\Users\Admin\AppData\Roaming\CHANNE~1.EXE
Size 1.1MB
SHA256 a5eeafe200e4938f1909611e2ad08dfe4b341457e172781b862f244dd6ac49b8
MD5 66c65bb1d9617dbb4b4321f3b767cd2b
SHA1 b4dde25a26364f05a1b8b7d77bb28e89a4d9c2b5
SHA512 a3abe91e6d0c5f84a72f21b9349134964a54efa3e2f396cf005455ed47c8d9d9b01fd9b152609a0946690f160d7ecab40656d744a371a4611b64d97419510c4c
SSDEEP 24576:poYSPFmIEQBzd104zi7jTc5wsxbtUdHZvKzNexqIP2ru85tc:pdSBzn0O6jTGbtUdtKzNexqIP25C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3464-0-0x000000007452E000-0x000000007452F000-memory.dmp

Download

memory/3464-1-0x0000000000360000-0x0000000000474000-memory.dmp

Download

memory/3464-2-0x0000000074520000-0x0000000074CD1000-memory.dmp

Download

memory/3464-3-0x0000000004EE0000-0x0000000004FC4000-memory.dmp

Download

memory/3464-4-0x0000000004FC0000-0x00000000050D2000-memory.dmp

Download

memory/3464-5-0x00000000056A0000-0x0000000005C46000-memory.dmp

Download

memory/3464-6-0x00000000051F0000-0x0000000005282000-memory.dmp

Download

memory/3464-7-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-18-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-56-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-70-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-68-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-66-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-64-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-62-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-60-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-58-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-54-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-52-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-50-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-48-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-46-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-44-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-40-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-36-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-34-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-32-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-30-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-26-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-22-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-16-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-14-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-42-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-38-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-12-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-10-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-28-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-24-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-8-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-20-0x0000000004FC0000-0x00000000050CD000-memory.dmp

Download

memory/3464-1343-0x0000000074520000-0x0000000074CD1000-memory.dmp

Download

memory/3464-1344-0x0000000005290000-0x00000000052FC000-memory.dmp

Download

memory/3464-1346-0x0000000005510000-0x000000000555C000-memory.dmp

Download

memory/3464-1345-0x00000000054A0000-0x0000000005508000-memory.dmp

Download

memory/3464-1347-0x0000000005590000-0x00000000055E4000-memory.dmp

Download

memory/3464-1355-0x0000000074520000-0x0000000074CD1000-memory.dmp

Download

memory/4060-1354-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4060-1488-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4060-1490-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads