Analysis

  • max time kernel
    103s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:08

General

  • Target

    2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe

  • Size

    582KB

  • MD5

    af3e80f37504aa273b1d40c5f9958cbd

  • SHA1

    452c38bc8484e6bf01ad4bb346c8c31f9e6e4aec

  • SHA256

    60552553afed7792fdaf1328bfbd55934e5af42ce7343ae7ea16806eb49d64ca

  • SHA512

    7ba687b5b86e27b1d6f96b2b8b0e140b8530ceefb24a82231eb254b9292bfe397d8ed6adfffe1127c108b3299f9f1ccec72b54661b0e8a953b34a17cc24d5057

  • SSDEEP

    12288:UzA3y/ehoPZ+83zS0QemGZHhu33E17XtE:U0iGhoR+6z/mGZHY3E17K

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5880
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:6112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

          Filesize

          86KB

          MD5

          3b73078a714bf61d1c19ebc3afc0e454

          SHA1

          9abeabd74613a2f533e2244c9ee6f967188e4e7e

          SHA256

          ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

          SHA512

          75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

        • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-07-04_af3e80f37504aa273b1d40c5f9958cbd_amadey_elex_gcleaner_neshta_smoke-loader.exe

          Filesize

          541KB

          MD5

          d6bb00c0059d1a147e1be60477260446

          SHA1

          fe00b9380a8340d5ed7e24b18534f98d9d74abb7

          SHA256

          480f8b4bc250a4bcdea746d134bcbdbb8b98fb697c14b73d928484d9653992b9

          SHA512

          225a81b475b9bcf76dd2c772c981a05d419959852fb8c439dfb6d19e6ad7603c3af38c9e01e5db01abc068d278b2a020aa14400a6d73ea80be2d0a2fe4ff3d6f

        • memory/5880-134-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/5880-135-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/5880-137-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB