36db131862e9f38c5e47cdb4aa1a35a8c95904039c1e5cbda5b6ba728fbebd79

Analysis

max time kernel
138s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Neptune-Stealer/main.py
Size

132KB
MD5

2ff241435d9b16d284c9d70ca1981e86
SHA1

5f3ea0fa89a37206e728ce8a5a64f24f1545d479
SHA256

d5f09d7355070d7e60d5bc0f79288df26fdc494d92c6a9467b1ae1232ddc8876
SHA512

8ca458206013ca07c82c6d8c98fb4bb78f79a7ef7858ba40e0866f4c75b9aced52634a8b56f15db4cc4bf50cd46b5548741623c943e6b01953402f74f3ee3084
SSDEEP

1536:FsoWfxPvvsfYhxPuR2BEz+mKtnCFl2NOmOorPKtpOz3rkpznn/8K3TWiixelRj96:Fpf2KIZCHnmOppOzQzH3T791Zrq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3252 OpenWith.exe

pid	process
3252	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Neptune-Stealer\main.py
1⤵
- Modifies registry class
PID:2620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads