Overview

overview

10

Static

static

10

2026-10-28...ub.exe

windows10-2004-x64

10

2026-10-28...ub.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 04:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe
  • Size 1.8MB
  • Sample261030-fbqljshs7x
  • SHA256 4c9b660e4abe81d594ccdcfd116544d97898438fb10d90a5a0cd34b1223058f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:4680

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MICROS~1.EXE
        • Size 243KB
        • SHA256 4fa9891a7eab6727c5969e97e54540d8af249e087d27bf679f2bc0e53d82b907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~2.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MICROS~2.EXE
        • Size 138KB
        • SHA256 385043c2181d0e9840ddcb0be2a401afc3bbf70df55ff36bbd307305b074e323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~3.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MICROS~3.EXE
        • Size 138KB
        • SHA256 cf9bc59e7a4d46d144e76e9dedc9725579317faad2995ffe6d4ec1e9fdc87bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~4.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MICROS~4.EXE
        • Size 315KB
        • SHA256 cb4c3075bd0e07d1f402fa9cf9f34c329685dad0ec69c3c6858229036c7aba62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MID1AD~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MID1AD~1.EXE
        • Size 413KB
        • SHA256 df537062474e062e4f0e1c46deb501bc71072183b547c1cdf6a65c1bd60125df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MIF4FD~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Temp\EUB7EC.tmp\MIF4FD~1.EXE
        • Size 281KB
        • SHA256 4ecc7ccfc6b7e3feb059a9ca17d4ca44d2213f53228fcff95d3459760b1e7d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateSetup.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB7EC.tmp\MicrosoftEdgeUpdateSetup.exe
        • Size 1.8MB
        • SHA256 4c9b660e4abe81d594ccdcfd116544d97898438fb10d90a5a0cd34b1223058f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-28_51313f90816143b95512f6bc25d6c80e_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub.exe
        • Size 1.8MB
        • SHA256 297a0dc2608b68abf4ef60e03c705fc8cfc7558d8f9555b363c1c0ce2974e345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/832-255-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/832-256-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/832-257-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/832-259-0x0000000000400000-0x000000000041B000-memory.dmp
        Download