eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
135s
max time network
178s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/neptunium.exe
Size

1.3MB
MD5

94259b5ad79024a5b6f5388f18ec061f
SHA1

975251f1d30d9e0c41a88ff58eaa98283d0b2c01
SHA256

100b97224063dbaea25b4d53672b7e3fc81443aeef10151c47096ffb3c849334
SHA512

1b66ddb7fecf930680557ca2e036902b6ac60754fb5fecf5283ad66c45dadfe0a1f1a876ca4a8ced007008c03df0b1720011bf5be692c5cd8db2ce8f3c63ee82
SSDEEP

24576:ImaUgySjNqBEmg4KDPowWMCRd53M9MNMVBvtEMFlMoYMMMsMMMLUMgMMMMM3wMMN:2qqmg4kPowWMCRd53M9MNMVBvtEMFlMl

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

neptunium.exe

description ioc process

File opened for modification \??\PhysicalDrive0 neptunium.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

neptunium.exe

pid process

628 neptunium.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 1296 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1296 AUDIODG.EXE

description	ioc	process
File opened for modification	\??\PhysicalDrive0	neptunium.exe

pid	process
628	neptunium.exe

description	pid	process
Token: 33	1296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1296	AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact