Overview

overview

10

Static

static

10

2025-04-21...da.exe

windows10-2004-x64

10

2025-04-21...da.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2025, 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe

  • Size

    459KB

  • MD5

    9331287b6cf7962736f833a4fb95fa72

  • SHA1

    f67c7cd2526b804e744e9e383e8ff14b0a791011

  • SHA256

    cc1d720d5da2885c50cd93547ccf8163d7b4bb7511c7f5756e4798e449306c53

  • SHA512

    2fee0cf116b194e0695a2ce5df45bb29f7567538d7c8674749ab2a72ec55e10b482746b11ab90582498c99335fbe7bf727ac40089fbab0540a38373c41d86825

  • SSDEEP

    6144:k97+QbqZ0/xDPK8JLM7hsqMFUtkko1mJ8+ANqTCOQ7bSLP:cmQx71M75tzOmJ8+5

Score
10/10
neshtarhysidacredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 6 IoCs
  • Detect Rhysida ransomware 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rhysida

    Rhysida is a ransomware that is written in C++ and discovered in 2023.

    ransomwarerhysida
  • Rhysida family
    rhysida
  • Renames multiple (2593) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\system32\cmd.exe
          cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3544
          • C:\Windows\system32\reg.exe
            reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
            5⤵
              PID:1512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6064
          • C:\Windows\system32\cmd.exe
            cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1408
            • C:\Windows\system32\reg.exe
              reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
              5⤵
                PID:1884
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Windows\system32\cmd.exe
              cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3448
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                5⤵
                  PID:4464
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5132
              • C:\Windows\system32\cmd.exe
                cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5432
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                  5⤵
                    PID:4948
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5124
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5452
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    PID:2588
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5008
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5228
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                    5⤵
                      PID:2816
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6076
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:624
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                      5⤵
                        PID:336
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1932
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:844
                      • C:\Windows\system32\reg.exe
                        reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                        5⤵
                          PID:4696
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4704
                      • C:\Windows\system32\rundll32.exe
                        rundll32.exe user32.dll,UpdatePerUserSystemParameters
                        4⤵
                          PID:5144
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe" -ErrorAction SilentlyContinue;
                        3⤵
                        • Hide Artifacts: Hidden Window
                        • Hide Artifacts: Ignore Process Interrupts
                        • Suspicious use of WriteProcessMemory
                        PID:3228
                        • C:\Windows\system32\cmd.exe
                          cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe" -ErrorAction SilentlyContinue;
                          4⤵
                          • Hide Artifacts: Hidden Window
                          • Hide Artifacts: Ignore Process Interrupts
                          • Suspicious use of WriteProcessMemory
                          PID:2780
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe" -ErrorAction SilentlyContinue;
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5656

                  Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Persistence

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Privilege Escalation

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Defense Evasion

                  Hide Artifacts

                  2
                  T1564

                  Hidden Window

                  1
                  T1564.003

                  Ignore Process Interrupts

                  1
                  T1564.011

                  Indicator Removal

                  1
                  T1070

                  File Deletion

                  1
                  T1070.004

                  Modify Registry

                  2
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  2
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Windows Credential Manager

                  1
                  T1555.004

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  1
                  T1012

                  System Information Discovery

                  2
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Defacement

                  1
                  T1491

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                    Filesize

                    175KB

                    MD5

                    576410de51e63c3b5442540c8fdacbee

                    SHA1

                    8de673b679e0fee6e460cbf4f21ab728e41e0973

                    SHA256

                    3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

                    SHA512

                    f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-04-21_9331287b6cf7962736f833a4fb95fa72_elex_neshta_rhysida.exe
                    Filesize

                    419KB

                    MD5

                    26f41a46d0addde100bb9512a130de5e

                    SHA1

                    bef7719a8a98131b8bdf885895b5d1c3f9d089ad

                    SHA256

                    0050a69d6e93eddcd1ea4b7e951945f8970e5700d9436238bde7f63d757988ae

                    SHA512

                    99d09fe0f657d3c965429094ca1d077c4e1a5f066b0ae022dd6f344af6d8ebc9a5a559be2ab11019216e516688f5fa5daac15bae8d5d524bd665c56cfa07bd41

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5nlszoz1.o24.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • memory/3608-1188-0x0000000000400000-0x000000000041B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/3608-1209-0x0000000000400000-0x000000000041B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/3608-1190-0x0000000000400000-0x000000000041B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/3608-1207-0x0000000000400000-0x000000000041B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/3608-1192-0x0000000000400000-0x000000000041B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/5656-1200-0x000001DCBFC30000-0x000001DCBFC52000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/5856-1194-0x0000000000400000-0x0000000000477000-memory.dmp

                    Filesize

                    476KB

                    Download

                  • memory/5856-1193-0x0000000000400000-0x0000000000477000-memory.dmp

                    Filesize

                    476KB

                    Download

                  • memory/5856-1191-0x0000000000400000-0x0000000000477000-memory.dmp

                    Filesize

                    476KB

                    Download

                  • memory/5856-1189-0x0000000000400000-0x0000000000477000-memory.dmp

                    Filesize

                    476KB

                    Download