Overview

overview

10

Static

static

10

2026-08-07...er.exe

windows10-2004-x64

10

2026-08-07...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe
  • Size 451KB
  • Sample260807-tw86aasshs
  • SHA256 b3f77cb5d2c31683d9b1983a805f64fcdb69246e5301b051a8e8da0684cd3c82
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 6 IoCs
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4616
      • \??\c:\users\admin\appdata\local\temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe 
        c:\users\admin\appdata\local\temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe 
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5772
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1264
        • \??\c:\windows\resources\themes\explorer.exe
          c:\windows\resources\themes\explorer.exe
          4⤵
          • Modifies visibility of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4724
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4820
            • \??\c:\windows\resources\svchost.exe
              c:\windows\resources\svchost.exe
              6⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1240
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe PR
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3152

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe
        • Size 410KB
        • SHA256 b42f1763bfb9b45cc9a26c2a455fa664c43f703144262c453f05ef72171d2a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe 
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-07_26a9ef46eb15deadc2c4b4fd2e0c77a8_amadey_elex_emotet_neshta_ransomhub_smoke-loader.exe 
        • Size 280KB
        • SHA256 1d8079a84701ea07896cca0d420ab882ce14714417342bf25bf685674e8dd093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        explorer.exe
        • Path C:\Windows\Resources\Themes\explorer.exe
        • Size 130KB
        • SHA256 49365b2229c31b45ee2057d6423c016f46cc12d63fa9beb1551f4e8171ff72e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 130KB
        • SHA256 4b1662290927969f74434da2c47f1831691f211f8cbb34f4242dad2d90831369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spoolsv.exe
        • Path C:\Windows\Resources\spoolsv.exe
        • Size 130KB
        • SHA256 b718ea0cb5927ee28cd4ced9e2cfd57d918e3870898bbb0000f07fd3047fe7a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Windows\Resources\svchost.exe
        • Size 130KB
        • SHA256 034ebe939d13d92dc1d22ffaf26adda0ae609b020ef9a1ff0dbfec3415111338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1240-196-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/1264-88-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/3152-77-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/4060-187-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4060-188-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4060-189-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4060-190-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4060-192-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4616-82-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/4616-9-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/4724-195-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/4820-80-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/5772-21-0x000000000042B000-0x000000000042C000-memory.dmp
        Download

        memory/5772-19-0x0000000000400000-0x000000000045C000-memory.dmp
        Download

        memory/5772-194-0x0000000000400000-0x000000000045C000-memory.dmp
        Download