Overview

overview

10

Static

static

3

2026-08-12...er.exe

windows10-2004-x64

10

2026-08-12...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
  • Size 1.8MB
  • Sample260812-tfa9badf62
  • SHA256 ea93981676f65bf9e8026e3bff1e570acc552ebc15ec5363ad32a823b7d1592a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 38 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe" -burn.unelevated BurnPipe.{C8AC3CF3-98F6-488B-9F1B-6307DE8872C5} {163F6CA5-EB2F-4403-A4D7-F236BF9660FD} 2632
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1156
  • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    1⤵
      PID:2148

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          20260812160026_75838be3c9374135af816cedad246288.trn
          • Path C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\vstelAIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20260812160026_75838be3c9374135af816cedad246288.trn
          • Size 6KB
          • SHA256 96036e19b55d61cddeda974509e9e0b5ab8625a6e46795d8a6ce7c8ff47e777d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_479febf2a76f59d882cdcc3455b6c2c1_amadey_coinminer_elex_neshta_smoke-loader.exe
          • Size 1.8MB
          • SHA256 9752bffeee916cc11994f5241019cce450f79572ffb27ff6efd69731414c7799
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperCore.config
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\BootstrapperCore.config
          • Size 721B
          • SHA256 b959e20c9f817b406b84ff7de06ac881471c9b8672e7e2666e948dc01f84c5f4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BootstrapperCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\BootstrapperCore.dll
          • Size 76KB
          • SHA256 cd2b03a835ed9cfdfa700e76fea8101d80de47b79dce14e63cd16afadfafc226
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ManagedUx.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\ManagedUx.dll
          • Size 819KB
          • SHA256 9975aa07245430a055b30f7baf084a616102b576a814a1c768c2f3f0acb8f7c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ApplicationInsights.PersistenceChannel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Microsoft.ApplicationInsights.PersistenceChannel.dll
          • Size 52KB
          • SHA256 56b3b4190ce0f056caf66b1b6f1667ff6d7d125206e3258ca4902606155404b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ApplicationInsights.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Microsoft.ApplicationInsights.dll
          • Size 176KB
          • SHA256 63a84de3597a8f6c966e7b9b3c045fcfcbce2a0ebd3db6ae84f29c94b70a6d1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Diagnostics.Tracing.EventSource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Microsoft.Diagnostics.Tracing.EventSource.dll
          • Size 154KB
          • SHA256 b443d6f13beed82c92b907ef2c2b8baeda342825bb132ecc1a3948c05aa1888b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.VS.PlatformInstaller.DynamicFeed.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Microsoft.VS.PlatformInstaller.DynamicFeed.dll
          • Size 475KB
          • SHA256 51bea96cd4eab62573a050aba0506edf1b45618ce3f06a568d1e96160eeea54d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.VisualStudio.Telemetry.Net35.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Microsoft.VisualStudio.Telemetry.Net35.dll
          • Size 252KB
          • SHA256 618a8d96baf2b503e725010c29417fda368a7668c9750975799b19163671be66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Newtonsoft.Json.dll
          • Size 420KB
          • SHA256 8cab8a4c8998d9c57bf146a38976af1247ca8c2056a5410d18e57ed234de397e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SkuResources.xaml
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\SkuResources.xaml
          • Size 8KB
          • SHA256 b1de715b3ed3ce17c47268a6661f3dc8c9ed729ca503dc673170e6aa6e032719
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\System.Threading.dll
          • Size 378KB
          • SHA256 8a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Themes.xaml
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\Themes.xaml
          • Size 4KB
          • SHA256 b39bc57ff669216ed23edfbcd57f6055fcd232e7e015b4eff27cf61361c93aef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbahost.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\mbahost.dll
          • Size 64KB
          • SHA256 c164b1bd80936370ff6016453cc9427cdbbf89245cf4aca8a6fa4d20ef06ea77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqmapi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{bd4ef7af-dfb1-472e-8fa4-1b97f360a3e7}\.ba1\sqmapi.dll
          • Size 221KB
          • SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1156-201-0x00000000047B0000-0x00000000047C0000-memory.dmp
          Download

          memory/1156-64-0x00000000047B0000-0x00000000047C0000-memory.dmp
          Download

          memory/2148-277-0x000000001B310000-0x000000001B446000-memory.dmp
          Download

          memory/2148-275-0x0000000001610000-0x0000000001630000-memory.dmp
          Download

          memory/2148-276-0x000000001AC50000-0x000000001B024000-memory.dmp
          Download

          memory/3036-228-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3036-265-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3036-263-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3036-200-0x0000000000400000-0x000000000041B000-memory.dmp
          Download