Overview

overview

10

Static

static

3

2026-08-12...er.exe

windows10-2004-x64

10

2026-08-12...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
  • Size 1.8MB
  • Sample260812-tlqaesdf97
  • SHA256 31342acc088607b41c369f2031958195ab2421e2f424a4e205294fbb2ce6803a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 34 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe" -burn.unelevated BurnPipe.{2F12244D-5387-4039-AD86-BE9E0C959A8E} {41AC53C1-7B1F-4144-B7E9-2312C95E0AEC} 4160
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4304
  • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    1⤵
      PID:5616

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_020c8ab9f85f8a8611018298a3d28328_amadey_coinminer_elex_neshta_smoke-loader.exe
          • Size 1.8MB
          • SHA256 21929c64de8d3eb2e6b17e205dad8cc13136c8d1d689ff048d7f69d5477e4f59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperCore.config
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\BootstrapperCore.config
          • Size 721B
          • SHA256 b959e20c9f817b406b84ff7de06ac881471c9b8672e7e2666e948dc01f84c5f4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BootstrapperCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\BootstrapperCore.dll
          • Size 76KB
          • SHA256 cd2b03a835ed9cfdfa700e76fea8101d80de47b79dce14e63cd16afadfafc226
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ManagedUx.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\ManagedUx.dll
          • Size 758KB
          • SHA256 dd1cf2f7f9d0acf405553db330bff0ae100abd2b764f80577b1ec8c822be8dee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ApplicationInsights.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Microsoft.ApplicationInsights.dll
          • Size 207KB
          • SHA256 53f4e9951d312f3da6683009fc4ae707ef5f6382f3bc28b20bf78d105e615dbb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Diagnostics.Tracing.EventSource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Microsoft.Diagnostics.Tracing.EventSource.dll
          • Size 145KB
          • SHA256 5fcfbccb2cf85460a0adb35b105c8eb1c875a1d4052252cc2d8098c12262872a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.VS.PlatformInstaller.DynamicFeed.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Microsoft.VS.PlatformInstaller.DynamicFeed.dll
          • Size 387KB
          • SHA256 9bedb0b319feb6a9aa5ac5b9fcbc4bc50a3189e286ddee5c1b1eb43c5dd4da93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.VisualStudio.Telemetry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Microsoft.VisualStudio.Telemetry.dll
          • Size 266KB
          • SHA256 56b24dd6dc1d1e97bff59f40588d7dc602de2db1cc89da2762deb94d00d2510a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Newtonsoft.Json.dll
          • Size 420KB
          • SHA256 8cab8a4c8998d9c57bf146a38976af1247ca8c2056a5410d18e57ed234de397e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SkuResources.xaml
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\SkuResources.xaml
          • Size 12KB
          • SHA256 8aaa63e7758657517f575a08c1acd5d15198b730146f6980dda93875fa9c26a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\System.Threading.dll
          • Size 378KB
          • SHA256 8a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Themes.xaml
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\Themes.xaml
          • Size 4KB
          • SHA256 a932fc2b397fe3cf65a13a8afcf30c7c3eea9a6a40c7123bad9cfc1a4ac8a1af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbahost.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\mbahost.dll
          • Size 64KB
          • SHA256 c164b1bd80936370ff6016453cc9427cdbbf89245cf4aca8a6fa4d20ef06ea77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqmapi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{f895a2f1-ae3f-4212-8af1-7fa1f8c212ea}\.ba1\sqmapi.dll
          • Size 221KB
          • SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1848-234-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1848-263-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1848-261-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1848-199-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5616-265-0x00000000010D0000-0x00000000010F0000-memory.dmp
          Download

          memory/5616-266-0x000000001A7F0000-0x000000001ABC4000-memory.dmp
          Download

          memory/5616-267-0x000000001AE10000-0x000000001AF46000-memory.dmp
          Download