36db131862e9f38c5e47cdb4aa1a35a8c95904039c1e5cbda5b6ba728fbebd79 | Triage

Analysis

max time kernel
100s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 16:32

Sharing

Report Analysis Logs

General

Target

Neptune-Stealer/build.bat
Size

734B
MD5

1a0f43689186eb6dc7638ec72d5163ff
SHA1

d425b292743605ca53ed1772def4eeae44e2ab14
SHA256

78c48bbdfc80dad96a91d87e00da3544f633b8602008b3a458d6a51306c7b86e
SHA512

a7a7dc92db73b61acb4e82d58e7e0d34c0ad3fd1e2244382a4086f9d046b241e4ec7b0abb7ec8ae1ff723edb6bbcffd6ca0e10d450793dd1709252a54378e498

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 5112 wrote to memory of 2044	5112	cmd.exe	cmd.exe
PID 5112 wrote to memory of 2044	5112	cmd.exe	cmd.exe
PID 2044 wrote to memory of 1144	2044	cmd.exe	cmd.exe
PID 2044 wrote to memory of 1144	2044	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Neptune-Stealer\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K run_script.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K run_script.bat
3⤵
PID:1144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...