Overview

overview

10

Static

static

10

2026-08-04...ar.exe

windows10-2004-x64

10

2026-08-04...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
  • Size 423KB
  • Sample260804-rasv3abh29
  • SHA256 ace193db0988128117c073a53cc19c40d6ce8065d3bfc2bb819b9c95d07a0688
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 8 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE" -490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE -490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          PID:2692
  • C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
    C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies data under HKEY_USERS
    PID:2220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrashReporter_64.dll
        • Path C:\ProgramData\Nexon\NGM\CrashReporter_64.dll
        • Size 1.4MB
        • SHA256 3f676a3df1267fc6e7b84f8ca39f4ff04f5cacb849f48dbb58d481a608f7ae11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGM64.exe
        • Path C:\ProgramData\Nexon\NGM\NGM64.exe
        • Size 385KB
        • SHA256 3a43ca3c66dcfcadf1933a356a1e919759644cdd8f059e0c5a35d5d626120732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGMDll64.dll
        • Path C:\ProgramData\Nexon\NGM\NGMDll64.dll
        • Size 7.6MB
        • SHA256 16f1e3c343353edb71c250d844f60d06c7e89d1a424f0a09fe52b8701ba20bc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGMResource.dll
        • Path C:\ProgramData\Nexon\NGM\NGMResource.dll
        • Size 1.3MB
        • SHA256 0e6e6961d7b68f11ddd9cc2ac31532f5a461ce31d87c4cf5d9d47b9891087c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebView2Loader.dll
        • Path C:\ProgramData\Nexon\NGM\WebView2Loader.dll
        • Size 158KB
        • SHA256 28b898e4433291c969cd4f3bc46377b195527ad9138df2fa57243ceb6717a6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nugu64.dll
        • Path C:\ProgramData\Nexon\NGM\nugu64.dll
        • Size 2.7MB
        • SHA256 abd1766290a755d0f8d0eabab7967de07d920f53d4034fab77586dc6b8ba4239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrashReporter.dll
        • Path C:\ProgramData\Nexon\NexonLauncher\x64\CrashReporter.dll
        • Size 696KB
        • SHA256 649ac7107e3efca55b69208a32d97dee64285b2b6f2f1e99cdc0e45a8bc3f501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NexonLauncher64.exe
        • Path C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
        • Size 434KB
        • SHA256 3bc2b9e95b64441b5f1d3704dbc24c5057f368f6a987b3f19c2db6b40ef2667d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9D6B3FE9E6E4067193F477ABAD990106
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9D6B3FE9E6E4067193F477ABAD990106
        • Size 1KB
        • SHA256 fac2e9ed7e425d47bd700da409f2c837551e1c80793c1d9ad312c766d7d91eea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9D6B3FE9E6E4067193F477ABAD990106
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9D6B3FE9E6E4067193F477ABAD990106
        • Size 246B
        • SHA256 0aa06aa89ada5e61a285e676dd2bf6652df2051948882b2edf6bce4dbcecb9e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
        • Size 383KB
        • SHA256 efcab4bbe63b79d757f667aa48e3338e98518f16186bf211a1102aad9ff94e2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tmp5023.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
        • Size 8B
        • SHA256 b0eb1a3ff7c4f1e836cda98e86deba816b8c66eb2861949a574f9855b8c9384c
        • MD5 SHA1 SHA512
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 699c17dbe6f62c53f7ba614abb7826da1b0190662eef062e5f51bff52264da4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3548-193-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3548-222-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4824-179-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4824-201-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4824-145-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4824-135-0x0000000000400000-0x000000000041B000-memory.dmp
        Download