Overview

overview

10

Static

static

10

2026-10-26...ub.exe

windows10-2004-x64

10

2026-10-26...ub.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 16:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
  • Size 8.4MB
  • Sample261027-ty322sev7w
  • SHA256 5f18190790bfdd99b371337ec879892eb94f394eaad471dd3a29c82aa195cd3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 7 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff6b9fb6998,0x7ff6b9fb69a8,0x7ff6b9fb69b8
        3⤵
        • Executes dropped EXE
        PID:1872
      • C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe" --version
        3⤵
        • Executes dropped EXE
        PID:4024
      • C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • Writes a Windows system DLL name to a user directory
        • System Location Discovery: System Language Discovery
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5360
        • C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x34c9cc,0x34c9d8,0x34c9e4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4440

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Defense Evasion

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Masquerading

        1
        T1036

        Match Legitimate Name or Location

        1
        T1036.005

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        additional_file0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\additional_file0.tmp
        • Size 2.9MB
        • SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        assistant_installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\assistant_installer.exe
        • Size 2.4MB
        • SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        browser_assistant.exe
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\browser_assistant.exe
        • Size 5.3MB
        • SHA256 f399f3c94ce8b3d6666a8f19a0c33d1e3e0b09ceef4887d323e7c4a35cfbd686
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbgcore.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\dbgcore.DLL
        • Size 196KB
        • SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbghelp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\dbghelp.dll
        • Size 1.8MB
        • SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        files_list
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\assistant\files_list
        • Size 72B
        • SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        de932af914ba00303d4a2778a383ac9c831101e2.crx
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\9f25476a-b4c0-49b3-a78d-e4dda7f891c1 Opera Installer Temp\opera_package_202610271628591\de932af914ba00303d4a2778a383ac9c831101e2.crx
        • Size 3.5MB
        • SHA256 9d645b0ce032688d4f3100cd1f1d178d3c2c9d04bb691144659b98b4931d8eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-26_5ccab63ba003327b35226cea0508ecd0_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
        • Size 8.3MB
        • SHA256 07615e6bf94841a360802ceb411b81e8329dd21b57c2045335b99c36c007f5d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
        • Size 40B
        • SHA256 c8c2e3ccb805a4a92019687d6013db6d2e9601da4bb97ac41b0cc4ef1c51785a
        • MD5 SHA1 SHA512
        Submit Download

        memory/4152-164-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4152-161-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4152-233-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4152-234-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4152-235-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4152-237-0x0000000000400000-0x000000000041B000-memory.dmp
        Download