neshta | 7aa07e1ad45026323d6a51af1a5e3e762cc4670d772e043e04d13c558b5eb0fb

Analysis

max time kernel
72s
max time network
80s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
28-05-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NiptuneRAT-main.7z
Size

59.8MB
MD5

b0a9e59c9d88a91d61faa639f2cc8d5f
SHA1

4f82c76dc2a6637f5f4575646cae4c84bbe2f62a
SHA256

7aa07e1ad45026323d6a51af1a5e3e762cc4670d772e043e04d13c558b5eb0fb
SHA512

592e1ff69ebbce29ef746badc494b17e8f660634a097f439c38e57a36da6701405752a55ba0e164d5a030883fb81518fc1929aed7f3a75837d742e9babad95d3
SSDEEP

1572864:ipxJYt13T6VBt3bQgzw4hHnGOrb7u5sO9:S6tgVBt3bQgU4hHGOv7uWO9

Score

10^/10

neshta njrat updatess evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

updatess

updates.ydns.eu:5553

Mutex

ed17c857327d5fedde4ca40303d765dc

Attributes

reg_key
ed17c857327d5fedde4ca40303d765dc
splitter
|'|'|

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe	disable_win_def
behavioral1/memory/3684-210-0x000002A627530000-0x000002A628E5A000-memory.dmp	disable_win_def

Detect Neshta payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zE8F1D97E7\NiptuneRAT-main\Plugins\Tools\NiptuneGrabber.exe	family_neshta
C:\Users\Admin\Desktop\NiptuneRAT-main\NDP481-Web.exe	family_neshta
behavioral1/memory/3104-653-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/3104-655-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

16 2396 wscript.exe
17 2396 wscript.exe
21 2396 wscript.exe
33 2396 wscript.exe
37 2396 wscript.exe
42 2396 wscript.exe
47 2396 wscript.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

784 netsh.exe

flow	pid	process
16	2396	wscript.exe
17	2396	wscript.exe
21	2396	wscript.exe
33	2396	wscript.exe
37	2396	wscript.exe
42	2396	wscript.exe
47	2396	wscript.exe

pid	process
784	netsh.exe

Drops startup file 4 IoCs

Processes:

WScript.exewscript.exeWScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsShell.Manifest.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsShell.Manifest.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.vbs	WScript.exe

Executes dropped EXE 11 IoCs

Processes:

NiptuneRAT.exeNiptuneRAT (2).exeNiptuneRAT.exeNiptune.exex.exeNiptuneRAT.exeNiptuneRAT (2).exeNiptuneRAT.exeNDP481-Web.exeNDP481-Web.exeSetup.exe

pid	process
1844	NiptuneRAT.exe
1464	NiptuneRAT (2).exe
3684	NiptuneRAT.exe
4632	Niptune.exe
248	x.exe
3416	NiptuneRAT.exe
1012	NiptuneRAT (2).exe
2684	NiptuneRAT.exe
3104	NDP481-Web.exe
1648	NDP481-Web.exe
3400	Setup.exe

Loads dropped DLL 4 IoCs

Processes:

Setup.exe

pid process

3400 Setup.exe
3400 Setup.exe
3400 Setup.exe
3400 Setup.exe

pid	process
3400	Setup.exe
3400	Setup.exe
3400	Setup.exe
3400	Setup.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

NDP481-Web.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	NDP481-Web.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WScript.exewscript.exeWScript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsShell = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsShell.Manifest.js\""	WScript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

Drops file in System32 directory 15 IoCs

Processes:

Setup.exe

description	ioc	process
File opened for modification	\??\c:\windows\syswow64\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\vcruntime140_1_clr0400.dll	Setup.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

NiptuneRAT (2).exeNiptuneRAT (2).exe

description	pid	process	target process
PID 1464 set thread context of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 set thread context of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

NDP481-Web.exeSetup.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\elevation_service.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge_proxy.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\pwahelper.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\pwahelper.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\identity_helper.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	NDP481-Web.exe
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml	Setup.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\cookie_exporter.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\Installer\setup.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge_proxy.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedge_pwa_launcher.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe	NDP481-Web.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\90.0.818.66\msedgewebview2.exe	NDP481-Web.exe

Drops file in Windows directory 64 IoCs

Processes:

Setup.exeNDP481-Web.exe

description	ioc	process
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\microsoft.windows.applicationserver.applications\v4.0_4.0.0.0__31bf3856ad364e35\microsoft.windows.applicationserver.applications.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.componentmodel.primitives.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.runtime.windowsruntime.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.xaml.hosting.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\uninstallroles.sql	Setup.exe
File opened for modification	\??\c:\windows\inf\windows workflow foundation 4.0.0.0\perfcounters.ini	Setup.exe
File opened for modification	\??\c:\windows\inf\.net clr networking 4.0.0.0\_networkingperfcounters.h	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\addinprocess.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.net.webheadercollection.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.xaml.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\windowsbase.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.activities.compiler.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_wow64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.xml.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.servicemodel.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\vbc.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.componentmodel.eventbasedasync\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.componentmodel.eventbasedasync.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_wp.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_wow64\presentationcore\v4.0_4.0.0.0__31bf3856ad364e35\globalserif.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\accessibility.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.data.entity.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\web.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\installroles.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.servicemodel.channels.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\edmgen.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\defaultwsdlhelpgenerator.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.csharp.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.common.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.xml.linq.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\applaunch.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.net.http.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\uiautomationtypes\v4.0_4.0.0.0__31bf3856ad364e35\uiautomationtypes.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\nlslexicons0009.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.web\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.web.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.diagnostics.process.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.activities.presentation\v4.0_4.0.0.0__31bf3856ad364e35\system.activities.presentation.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.xml.xmldocument.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\web.config.comments	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\fonts\globalserif.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\msbuild\microsoft.build.core.xsd	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_wow64\system.printing\v4.0_4.0.0.0__31bf3856ad364e35\system.printing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\servicemodelreg.exe	Setup.exe
File opened for modification	C:\Windows\svchost.com	NDP481-Web.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\presentationframework-systemdrawing.dll	Setup.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe	nsis_installer_1
C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1644 schtasks.exe
2400 schtasks.exe

pid	process
1644	schtasks.exe
2400	schtasks.exe

Modifies registry class 64 IoCs

Processes:

OpenWith.exeNiptuneRAT.exeNiptuneRAT.execmd.exeNDP481-Web.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	NiptuneRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000a8580b6a1000372d5a6970003c0009000400efbea8580b6aa8580b6a2e000000839f020000001c000000000000000000000000000000fab9aa0037002d005a0069007000000014000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	NiptuneRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\Registry\User\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\NotificationData	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000a858356c110050524f4752417e310000740009000400efbec5525961a858356c2e0000003f0000000000010000000000000000004a0000000000bae65800500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	NDP481-Web.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6295c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NiptuneRAT (2).exeNiptuneRAT.exeNiptune.exeNiptuneRAT.exe

pid	process
1464	NiptuneRAT (2).exe
1464	NiptuneRAT (2).exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
3684	NiptuneRAT.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
4632	Niptune.exe
2684	NiptuneRAT.exe
2684	NiptuneRAT.exe
2684	NiptuneRAT.exe
2684	NiptuneRAT.exe
2684	NiptuneRAT.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

1556 OpenWith.exe
4600 7zFM.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

7zFM.exeNiptuneRAT (2).exeNiptune.exeNiptuneRAT.exeRegAsm.exeNiptuneRAT (2).exeNiptuneRAT.exeSetup.exe

description	pid	process
Token: SeRestorePrivilege	4600	7zFM.exe
Token: 35	4600	7zFM.exe
Token: SeSecurityPrivilege	4600	7zFM.exe
Token: SeDebugPrivilege	1464	NiptuneRAT (2).exe
Token: SeDebugPrivilege	4632	Niptune.exe
Token: SeDebugPrivilege	3684	NiptuneRAT.exe
Token: SeDebugPrivilege	2268	RegAsm.exe
Token: 33	2268	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2268	RegAsm.exe
Token: SeDebugPrivilege	1012	NiptuneRAT (2).exe
Token: SeDebugPrivilege	2684	NiptuneRAT.exe
Token: 33	2268	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2268	RegAsm.exe
Token: 33	2268	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2268	RegAsm.exe
Token: SeDebugPrivilege	3400	Setup.exe
Token: 33	2268	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2268	RegAsm.exe
Token: 33	2268	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2268	RegAsm.exe
Token: SeDebugPrivilege	3400	Setup.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

7zFM.exeNiptuneRAT.exeNiptune.exeNiptuneRAT.exe

pid process

4600 7zFM.exe
4600 7zFM.exe
3684 NiptuneRAT.exe
4632 Niptune.exe
2684 NiptuneRAT.exe
3684 NiptuneRAT.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

NiptuneRAT.exeNiptune.exeNiptuneRAT.exe

pid process

3684 NiptuneRAT.exe
4632 Niptune.exe
2684 NiptuneRAT.exe
3684 NiptuneRAT.exe

pid	process
4600	7zFM.exe
4600	7zFM.exe
3684	NiptuneRAT.exe
4632	Niptune.exe
2684	NiptuneRAT.exe
3684	NiptuneRAT.exe

pid	process
3684	NiptuneRAT.exe
4632	Niptune.exe
2684	NiptuneRAT.exe
3684	NiptuneRAT.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

OpenWith.exeNiptuneRAT.exeRegAsm.exex.exeNiptuneRAT.exeRegAsm.exe

pid	process
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1556	OpenWith.exe
1844	NiptuneRAT.exe
2268	RegAsm.exe
248	x.exe
3416	NiptuneRAT.exe
1828	RegAsm.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

OpenWith.exeNiptuneRAT.exeWScript.exeNiptuneRAT (2).exeRegAsm.exeWScript.exeNiptuneRAT.exeWScript.exeNiptuneRAT (2).exeNDP481-Web.exeNDP481-Web.exe

description	pid	process	target process
PID 1556 wrote to memory of 4600	1556	OpenWith.exe	7zFM.exe
PID 1556 wrote to memory of 4600	1556	OpenWith.exe	7zFM.exe
PID 1844 wrote to memory of 1464	1844	NiptuneRAT.exe	NiptuneRAT (2).exe
PID 1844 wrote to memory of 1464	1844	NiptuneRAT.exe	NiptuneRAT (2).exe
PID 1844 wrote to memory of 1664	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 1664	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 1664	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 4744	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 4744	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 4744	1844	NiptuneRAT.exe	WScript.exe
PID 1844 wrote to memory of 3684	1844	NiptuneRAT.exe	NiptuneRAT.exe
PID 1844 wrote to memory of 3684	1844	NiptuneRAT.exe	NiptuneRAT.exe
PID 1664 wrote to memory of 2396	1664	WScript.exe	wscript.exe
PID 1664 wrote to memory of 2396	1664	WScript.exe	wscript.exe
PID 1664 wrote to memory of 2396	1664	WScript.exe	wscript.exe
PID 1464 wrote to memory of 5008	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 5008	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 5008	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 2268	1464	NiptuneRAT (2).exe	RegAsm.exe
PID 1464 wrote to memory of 1644	1464	NiptuneRAT (2).exe	schtasks.exe
PID 1464 wrote to memory of 1644	1464	NiptuneRAT (2).exe	schtasks.exe
PID 2268 wrote to memory of 784	2268	RegAsm.exe	netsh.exe
PID 2268 wrote to memory of 784	2268	RegAsm.exe	netsh.exe
PID 2268 wrote to memory of 784	2268	RegAsm.exe	netsh.exe
PID 4744 wrote to memory of 248	4744	WScript.exe	x.exe
PID 4744 wrote to memory of 248	4744	WScript.exe	x.exe
PID 3416 wrote to memory of 1012	3416	NiptuneRAT.exe	NiptuneRAT (2).exe
PID 3416 wrote to memory of 1012	3416	NiptuneRAT.exe	NiptuneRAT (2).exe
PID 3416 wrote to memory of 4696	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 4696	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 4696	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 720	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 720	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 720	3416	NiptuneRAT.exe	WScript.exe
PID 3416 wrote to memory of 2684	3416	NiptuneRAT.exe	NiptuneRAT.exe
PID 3416 wrote to memory of 2684	3416	NiptuneRAT.exe	NiptuneRAT.exe
PID 4696 wrote to memory of 3656	4696	WScript.exe	wscript.exe
PID 4696 wrote to memory of 3656	4696	WScript.exe	wscript.exe
PID 4696 wrote to memory of 3656	4696	WScript.exe	wscript.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 1828	1012	NiptuneRAT (2).exe	RegAsm.exe
PID 1012 wrote to memory of 2400	1012	NiptuneRAT (2).exe	schtasks.exe
PID 1012 wrote to memory of 2400	1012	NiptuneRAT (2).exe	schtasks.exe
PID 3104 wrote to memory of 1648	3104	NDP481-Web.exe	NDP481-Web.exe
PID 3104 wrote to memory of 1648	3104	NDP481-Web.exe	NDP481-Web.exe
PID 3104 wrote to memory of 1648	3104	NDP481-Web.exe	NDP481-Web.exe
PID 1648 wrote to memory of 3400	1648	NDP481-Web.exe	Setup.exe
PID 1648 wrote to memory of 3400	1648	NDP481-Web.exe	Setup.exe
PID 1648 wrote to memory of 3400	1648	NDP481-Web.exe	Setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NiptuneRAT-main.7z
1⤵
- Modifies registry class
PID:4736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NiptuneRAT-main.7z"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2192

C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe
"C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\NiptuneRAT (2).exe
"C:\Users\Admin\AppData\Local\Temp\NiptuneRAT (2).exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:784

C:\Windows\SYSTEM32\schtasks.exe
"schtasks.exe" /Create /SC MINUTE /MO 10 /TN "AppManager" /TR "C:\Users\Admin\AppData\Roaming\AppManager\NiptuneRAT (2).exe" /F
3⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsShell.Manifest.js"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WindowsShell.Manifest.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2396

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SecurityHealth.vbs"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\x.exe
"C:\Users\Admin\AppData\Local\Temp\x.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:248

C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe
"C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3684

C:\Users\Admin\Desktop\NiptuneRAT-main\Niptune.exe
"C:\Users\Admin\Desktop\NiptuneRAT-main\Niptune.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2096

C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe
"C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416

C:\Users\Admin\AppData\Local\Temp\NiptuneRAT (2).exe
"C:\Users\Admin\AppData\Local\Temp\NiptuneRAT (2).exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Windows\SYSTEM32\schtasks.exe
"schtasks.exe" /Create /SC MINUTE /MO 10 /TN "AppManager" /TR "C:\Users\Admin\AppData\Roaming\AppManager\NiptuneRAT (2).exe" /F
3⤵
- Creates scheduled task(s)
PID:2400

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsShell.Manifest.js"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WindowsShell.Manifest.js"
3⤵
PID:3656

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SecurityHealth.vbs"
2⤵
PID:720

C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe
"C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2684

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4596

C:\Users\Admin\Desktop\NiptuneRAT-main\NDP481-Web.exe
"C:\Users\Admin\Desktop\NiptuneRAT-main\NDP481-Web.exe"
1⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3104

C:\Users\Admin\AppData\Local\Temp\3582-490\NDP481-Web.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\NDP481-Web.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648

F:\4ce83b6887b23d383a5f458b6e\Setup.exe
F:\4ce83b6887b23d383a5f458b6e\\Setup.exe /x86 /x64 /web
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NiptuneRAT (2).exe.log
Filesize
847B

MD5
2940b232afa412901f8ae5651c790f93

SHA1
f79bd5d1433c803515e2d9a016396344187beea2

SHA256
16f4a7736a0c2aee54256d3d75ce4c0816fabf130b3b92340deca34c5f5fda43

SHA512
553d5491c9bc358c7ce8a95caa445e882ab4bf744a2f5be1b2131c20f27321f65121389fd076558ba415f322fdad6ed36a05902e5c55cbbeace371182890af27

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\NDP481-Web.exe
Filesize
1.4MB

MD5
39304ce18d93eeeb6efa488387adaed8

SHA1
22c974f3865cce3f0ec385dd9c0b291ca045bc2c

SHA256
05e9ada305fd0013a6844e7657f06ed330887093e3df59c11cb528b86efa3fbf

SHA512
4cf7f831fc1316dd36ed562a9bd1fda8cca223d64d662f3da0ade5fddc04be48c2d40333ba3320ee2d6c900e54c4f7e4f503897793e86666eac7e242d8194f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8F1D97E7\NiptuneRAT-main\Plugins\Tools\NiptuneGrabber.exe
Filesize
872KB

MD5
9ad41ae99f3f8c65408cc867fcddf435

SHA1
6d102c1d0167935ecc3b77ad6a1fffd70bd29b29

SHA256
d9297944e8e89452edb02a9c846309f3b95da4f582dd278a74129094128b1fcc

SHA512
55bcb43d7da2c7da8f2f1437cc0b662e402c0b97fb0cc5199086037759d70e37c88180468f62fd55bc0e0074abd4df5d7a45a6cf9c6cd653a4cf9fff176c8414

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI42D1.tmp.html
Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiptuneRAT (2).exe
Filesize
242KB

MD5
7042376d4cc587d1db8a205df6a7956b

SHA1
9cb998dbb577bd5d1e2308491a3110432d5929b3

SHA256
a9e50e8d4bb0ac18439c7c92fd52502ac13f492fa5cd16d48fde03b6a8df94c2

SHA512
0deabe844debf978d0117b7f3adaeee8d783baa3c144f865f9e5c4b9546c634d31cb539332405106c0656ae69c0434de96d31b47a56680637acae7da6c0f9dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiptuneRAT.exe
Filesize
25.1MB

MD5
6239058e48e0ff85e5d2b986fe55e46d

SHA1
53ecbc7f6d571f94cfbf6b489f0efd562caef1d4

SHA256
77f38316f69bf30036180f76cf2f31d8f456021a06b1bd2d3b185a295d69fac4

SHA512
1d3fb64d902a14df7ef6da783d8e19bfea599bb1e36d675b2a8607bbe9d2be7d03ec444b64834d40f75518b9995537062a8181bb502a7ac027e3f4de95ec2988

Download Submit
C:\Users\Admin\AppData\Local\Temp\SecurityHealth.vbs
Filesize
1008KB

MD5
768a73c8044aaca7b6f391dd133d0d04

SHA1
abb155227a1f1eed260c4d0242dbf2996d5fb789

SHA256
a70eef7927166fbe9cefc14ef5bd9f8f941ba5650cf1d227238a857c619818b3

SHA512
f2387aca16dc61f5f77396df6ef5be6d7924ba3c2325746c3bed77e4063d9ef20809e7ba50aeb8ae37e3779c548bdb06c04e39879f72c998ee7376e996d54a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsShell.Manifest.js
Filesize
433KB

MD5
1cb82e484fadb664a92ab1f53ab4cc48

SHA1
d4063184dd8a72fdf4b9bff7b7ffd075cb540bc9

SHA256
fada83aede0dac730c041b0308a3590e49e526777fdd10ce8be5a301c1badd36

SHA512
e6f981257577e5620588aeea7f12f950dd5d61c4e2ed1676426111ab6b9f2a2c39922a4b22fb390fd807e24eb239924c3178eaa55ff83643dada62c709184fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe
Filesize
44KB

MD5
6d50e65a9ae126590e496dfaea189d94

SHA1
d1464ac23af5b3e16aad6b8a5c76cee625132e00

SHA256
593a7c343e03f6cacc1b795836c77147f5fc81eaffb6c437fc3a4b8e9bbd4055

SHA512
6eb06127dfffb8b30e07499e6ee927a3e0deedfdc5a3259cdf9444093da31f1193c70e1f01ba2667a3d066ff6913dd622d02f64178029fb92f079eef13ae0d33

Download Submit
C:\Users\Admin\Desktop\NiptuneRAT-main\NDP481-Web.exe
Filesize
1.4MB

MD5
cbf28c2c24c84ed6575075d61747aa72

SHA1
6ffc087e18c8fb55ea44e3c58f53046f88590a92

SHA256
bb20039e6e2a1182ec5d4ae41476a152bfd41325a99d0afd58ccdb92ec6f8339

SHA512
58676f953eaa288094e5fc56989135bf8dd29a09860ca7f19ebcc60be2e6f8a7d974929da85d032506ed18a8daf4dd6723b6f0a90659a5ac2acec063d63097fc

Download Submit
C:\Users\Admin\Desktop\NiptuneRAT-main\NiptuneRAT.exe
Filesize
17.2MB

MD5
65e6549e222b17a2fa6bceeaddf101b5

SHA1
0cc142899c06f5ad31d8050a9ede78661126677f

SHA256
633b7335bbd4324f9ed0b4e648d2620b0da0a090eaac91b093ffc2a3bdc842e6

SHA512
3b48c6fe6b885a093f0d38f7d08ab4d861b4d6236d9fd6c2476e9747f2bd15183725e3c0ff79e85c45c690f3187ef7e6c2cc1a6c593359128ebdc7bb9337169d

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1025\LocalizedData.xml
Filesize
81KB

MD5
075961c7e742c66ee4cd8b614a778141

SHA1
a5541fa0487135aaed1c336bba79e8025ac2804c

SHA256
4198a6ae89b0be8bd07ed3c18dea6ca87239a5a47343b73ff612ce0ab47e08dd

SHA512
c6881fc501805d0cb5aa9b42fc14029404a236166699e3845586e0609c26e4536bdd6ca2181e1139f83d5cb78c35d0fa7d158134f522fb9f4736880e330fc8f6

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1028\LocalizedData.xml
Filesize
70KB

MD5
8b37256ce099957b91ebe1d51ad8f61c

SHA1
6bf4bcf46781126ffdce92e39ad4d1d912e75ac5

SHA256
7d6777e8c9484229c1b8e3f2e354a88f57539503c2c56f2b0ee47679a6ef9cc0

SHA512
6659dec6fae7a7f733a0c9e44a04f178a6732e1b9b785833c63efd8ed6e25adabb58e37b2ec039dacdb071732f8ee42ceb297cb2ec72b67e8d25eb093d5423a5

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1029\LocalizedData.xml
Filesize
87KB

MD5
aadf97951359a8267f7990cdd2cc950d

SHA1
61f626b44e252e916c9c70a4222efc9c21d951c6

SHA256
e28d2d89fc269d25272956cee4d7150a30706f58ad305e84e3c1c9fe7ac0ee86

SHA512
2d352cf7d8d167b2a9fd4416582328d894619f2eb213fd334e1b15ef1044735a69ffca36fba02d9d1af6355e9d1a55d38c3b7f5339ecacb8c1dfdc4cc50c5342

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1030\LocalizedData.xml
Filesize
84KB

MD5
e1f2f586d75650df1a751d86bb659df8

SHA1
283097241e6b1acc8f30ca822585df104c918e51

SHA256
615a6380adcfa3a0e7a5db2df9b98dad650678d8c46b1c7c3f2d2854204f079e

SHA512
b7fb3e366a7e5cbaaf99e8e14731653dd14885cd0b3d5462c091113f12800478ff2e5bd351bd403abaeef3041cdd5a7693825e488f27ec48d087686c95daa774

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1031\LocalizedData.xml
Filesize
89KB

MD5
74d28384c38283518c6490bfd068ebf1

SHA1
c52d2fd41a59691e18871ec64db10c43f241fb6c

SHA256
01afd814b009538f387812f6940c863a9d0cd7dc4159050f34f82e50ecbc33f8

SHA512
e23ae604eafab0c3a0d8aeb07321c0dd629d21c5ba47d37958f48f1b9f27d89de4db880ec3958ad1e5f2165a69bed18d61f73f71fd743a2d7eaafdc0ef8d1cc0

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1032\LocalizedData.xml
Filesize
91KB

MD5
233d0d1551b17f2284ad80674569de79

SHA1
67cd31126c6e5547e60d7266e61b6835b80b5916

SHA256
7106a1121056a73fed77aab7c7293dddffe0f5aecd7db969799a121ad5d88181

SHA512
c3375081c704fb05c7335929505ef4589fa728c97bb58738932b7ee05dd6e00c19d8ba14bb0a8dfce0d51ac73fa76bffa0ccc00772b73850eea37d39088a0473

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1033\LocalizedData.xml
Filesize
84KB

MD5
31bff8efc0cc701092ab7fe606271d65

SHA1
844cc4837ebe3eea9563df6613989b4588d6f19c

SHA256
b3048715a23d9bd77e9b3e1ec8577f94cfc8c2dd30b61dbf326871a97aa6e22c

SHA512
472b881df9128c93f9183ab05d2406146aeef8ce9723c9dcfa6e93d093d90b2db75bb4a3f784d26db187436242409f021fa8b7844aa04bf9cb58f48a6c4822d5

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1035\LocalizedData.xml
Filesize
85KB

MD5
c78dddce3189c67c23f60561dcacd4a8

SHA1
e375a6d1f71709ead1ad4139b1c16476019666d2

SHA256
e9353dedb338ce826b3b990851a955da1b04e484a378cac7c3c17a2de26d14a4

SHA512
a58d995936f5c5310e04f7514c177a071f3451638f0a9692593c4d505c5f48caeca1cee9644b092bf32bd70c52bb956f0b87ac748190aea2040adc3afbbab3b0

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1036\LocalizedData.xml
Filesize
89KB

MD5
d7e814adae1a18958416b7e29ae7078b

SHA1
857fed2c8766102d1a64d91eccb0661f6de750fd

SHA256
c8c847bf9ddf8998520123ff0a638c6e9843c860b68943275b7f0256f324c4ce

SHA512
73ad8b3d24ace1795c93ef807b3e644512fee2a295eea05a93fea07d131746aa99f895a68075efe44c2c4e305da3881c27a342d2fa13dd6d1f258a9cc669491a

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1037\LocalizedData.xml
Filesize
79KB

MD5
a258bd1060df46dcefe6257d4af638dc

SHA1
9e989db32e94499a717c93e889ebf47787509a42

SHA256
83120845e156ecbd401a9047365647cf8e9b2ec75d9295237da33c53eda365e4

SHA512
6f69aa98e264e3de3669f52e34140bf3a1bc333e3e3c4e06228eb1a78aabde380c8a444d9086a1f1188c49ead7ca73962db488dfb8e4e13c09ebf539ae53d011

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1038\LocalizedData.xml
Filesize
88KB

MD5
1b59e64e51b3f9b96e8897d5b9b17c37

SHA1
1fdd8951133add26ae062da306133980e31809b0

SHA256
5dfa759937eb0ee393d94485e0ac74546d344f342fc3d42ad33847ebbd5163e4

SHA512
f1cb4670805ccd1327a7ea31b98caccc7c5bc7cb7ea7817a5749b0e176f4bdae36339d25d1037f9cdb19a47bcaac4e53fc49656c365ee7981473264b55f2a996

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1040\LocalizedData.xml
Filesize
87KB

MD5
3192c0f7f30df881ec199d77b095b93e

SHA1
dca1cfe248a9de56f2d207d5f1979c92e006831c

SHA256
5dceb300d25c68003d61437e3802f97e1d5503e27032989338f7d260c7b0904e

SHA512
42a5f98103e23d7e8d7a34f8ba08d027ac4317d92109565b5f3fa4fd7057104d3a12b88846bee1914451cff59ed1b46e9146592784c09cd724bf004eb65864c3

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1041\LocalizedData.xml
Filesize
76KB

MD5
4cfdb16e84869a51119e17a545ace7a2

SHA1
5eb358e13291d65ff8805513254b02ff3b83d7c6

SHA256
1c2587f7c0d7e57494061d24638a83c8f9d33a4eb192cfe6bd65c172fb6a76a4

SHA512
381878c16a98aae9ef688bf4735b13d2d42b2c115d76c1677f5c275db3745b35fac35468f11d80284307a6f5ed93265fa2c378a5199284d848fdf984f2a88daf

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1042\LocalizedData.xml
Filesize
74KB

MD5
401f386416c7c37f92da9ec1688d750b

SHA1
c6565b80ba557827e3e6b96901f27fdcd1b525c6

SHA256
721cf8956fb2fb01df302713351eb9721cfccff096dc429d02b0f2b150855919

SHA512
f4ac60826287262b87bd407c85091d583ac504645faabd6fe8e116ac50e35908341d85850e8888e5928cb8235101e6b7a1074597946d584550e8aea6a7fba591

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1043\LocalizedData.xml
Filesize
86KB

MD5
18efd16361a280efe263f261a4faa21e

SHA1
6e5bbbc46b2decdb00cd957d02e27bbbf2a4d880

SHA256
88de82f8c0934f23e0eb16224def959ff55da396610bd34149e4fb9aab24fb03

SHA512
b4bdaf600c5a855c040db974744b780c4860474c38ec453c4bfdc5a11c8beff65437d17c5ab0c3c78b5b861d93b0d41f1c3f4d5d435d233ba3719f78c9058446

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1044\LocalizedData.xml
Filesize
85KB

MD5
a9998c1f395c44bcd41faa0ae60439e4

SHA1
4a267707c7dd8a24eed4c433b3c41b7e1a6a936b

SHA256
8165d0b468d73347a495f525dc81d847bb84b3391c8af1abc95e2b8f4a51d620

SHA512
9f0fb00c34ee788f9e8058915794b822fcb31f1c35a1d47ce5da2b15bae904cab513d55111ae4cccbf4da2587a4c3e045f0cc2e95654c9b5631a3a4a86632bd3

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1045\LocalizedData.xml
Filesize
88KB

MD5
5eadf11a5b9af3f40b21328474ba3b7e

SHA1
af456b6123f9adf4ea0b926124b926ea3056248e

SHA256
4362c962c7611190999b36e139370245104b66398ebddd56b210810440c43e88

SHA512
e0f0c32c736d23d40508daaa2fb7b7033034154869a4f411aa4ff96c7ff197d97b1d89eb4a6da1dbfeacdd3373c45f22bdda70554521bbce409c051ae4573e42

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1046\LocalizedData.xml
Filesize
85KB

MD5
361a4c229849b55e4540943b5c04403c

SHA1
46a0751432df223c936393f21a7543a3b314157e

SHA256
c2afb880f0986ca807b1dacbd5a9f2a5b9be4930c29379cdd88a6ebf9b0618c1

SHA512
40ba8c19286f992e5742f342532161062c36504aa3a364cdaee15e2e3ab750012d6502278d064f45b3df13b3063c66a361d688adbcaa6eb7a657c9a50e0e9380

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1049\LocalizedData.xml
Filesize
87KB

MD5
f65088c4998e6ca3a872fc66bdd2a192

SHA1
c697a3a043a6104befd6f8e1b85e746c3d84e390

SHA256
3b2c633bb0a7342418aef0ce29331643a4cd48a572ddbb90c3d3433d135fd952

SHA512
a5938da7cab6e963c553de1c135ee9c7ec565fc97ed4d433dfff9debb5d31ba3bbf3d1b8a12e814462fd92f4c39680ae71dbd2e3df846f23a1a98921f3981992

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1053\LocalizedData.xml
Filesize
84KB

MD5
a6f6198758552f453df96c4a8fb84134

SHA1
c40dd5faafe457c6c814695b4885f065f9d2f4bd

SHA256
b28bd460c2df31315297083c5507c233a569e1e89547127191468598b35eb36e

SHA512
9b958a0556d5989f71d1e38848c8b6b54ff6bfe292ad599b81e808f4c193cd41a23885d806539a0c246b811519a73d5fe7b0ce679c53119cfa97f999784fb66b

Download Submit
F:\4ce83b6887b23d383a5f458b6e\1055\LocalizedData.xml
Filesize
84KB

MD5
c515bca575c7e7e7dba8c1ac2a3031d7

SHA1
3aa307513e55a2ada4866ff8fcb2de4e5184a1ad

SHA256
98b5b75b8a89606dfcb54c622884671211199dffced96c29269010b81b06231a

SHA512
5a8c51f55aa6ae44f0a6932a30f0054e8c012080696d5fc784a3ec89aa63275978440364e6b9663eab5466af459594fd1c5d517c629f312bc9b4943e9e040a29

Download Submit
F:\4ce83b6887b23d383a5f458b6e\2052\LocalizedData.xml
Filesize
70KB

MD5
83242627ea9f4ea7c346a8830026eeb5

SHA1
75a8f52fa3e03b2f04b168d517117f80212b5672

SHA256
4577902142bb96b849f6b78866a5e81c761109a454470948902a40c73f7b9b7f

SHA512
cd27e3ad4168b7bb61b2336f73cd9f61516b953271aeecafbe22cbcffe18ef45d4a4e2c7513c3986939ffd635f2e7d1868798182ffcb4ae0e7aa207c5bc67bc2

Download Submit
F:\4ce83b6887b23d383a5f458b6e\2070\LocalizedData.xml
Filesize
87KB

MD5
50b9f5f566fd83ceeb0fd0992739388b

SHA1
c040e31d59580541bbcbd662598e8d3fbf52b51e

SHA256
4aa6b559e8993de92797e0d1c595cec0bf305403dd275a231f8417ba4c09c1a1

SHA512
87736f5db8bbcbe4924667e8f5820dc5329e902632d22480ac4768023215fd0db399f442eb1ba76ab2c5c008e58611f006cae4307605a5340380127fd83f70a4

Download Submit
F:\4ce83b6887b23d383a5f458b6e\3082\LocalizedData.xml
Filesize
86KB

MD5
14005b857dd90ec8bde8e80c3cb0faea

SHA1
7aa4e6f4c9feb808b2dc95f7541bd10aee02874b

SHA256
9d3fd31e3826b91d68ea34a6961cf288e23251cdf8faf0aad02653a55c53f2e0

SHA512
5ad424144a47fcc47ce5a33225a7cb1017b4278b5e3241da48213e132c4cef549ea3c107e7789f42886bdc0a343f50fcd0fc0b287efaff010bc1186251c5c0ec

Download Submit
F:\4ce83b6887b23d383a5f458b6e\ParameterInfo.xml
Filesize
1.0MB

MD5
4a0c5e0d81034c74bedc85b7f4759888

SHA1
d2c13fca6d918c7b4d25c8b9290bac053c551694

SHA256
5b872fc7d87f00634137d4051ee6f4cf481f9f7e0163ae7589a6c40a7c828569

SHA512
913425ea56c02ec136ee6eab4ab6a44e6a61f428ee431df241e2c745377d33835a6ecac69a8d02596f2adbbbf602a8afe578a05a1e3d253aa6e60e5666e1214c

Download Submit
F:\4ce83b6887b23d383a5f458b6e\Setup.exe
Filesize
118KB

MD5
f7a63e2d4217b71d39e4b18b3dadf632

SHA1
c3446cd1a50f6374c3ad3446607864bee97426d9

SHA256
43290269962f9edb13d042d54973a76570f6e4b6a4af33e7362f8284b9083720

SHA512
1703b6c1b1f96febdee8663fa9e8e11939715781810f5feccc6f11b0298fed4f83f6decd975ed1c05dd0e976a12b0738040d0c09db46389a2720462a6624c942

Download Submit
F:\4ce83b6887b23d383a5f458b6e\SetupEngine.dll
Filesize
899KB

MD5
9964ce1f4874a686910dbc1aeec1a326

SHA1
0b434c566f6722c765245a1228b7600fd10ba1c9

SHA256
3a45fbe9c5e03f67b49808c068eb2ce831e4eebdd1b38e520e4be5a5537a72e4

SHA512
8d123ab8e6b767a80d122b021a77460373e2b0841c92375ba1f56830529a2610bbf3749ce95aa64b67f45591378246409f035518feced582c7ebe1b6609dba99

Download Submit
F:\4ce83b6887b23d383a5f458b6e\SetupUi.dll
Filesize
341KB

MD5
b90a60068318cefa24e3344c4ef71649

SHA1
e61893f999442bbf6c0b1fa4c154fddb3be721f1

SHA256
1f757ea33835920a08fd9558f973761f70bc63a8c01fda4db1170e19ebf0c73d

SHA512
372d17ddc5ecc1190a81be67d1e9a256e9d52d1225a0de064dcebc3b7da983412a3ec1c5cb4f3f1abfe5a1fb3cc69157abbdf05e1c6bbea368d0a357afbd611b

Download Submit
F:\4ce83b6887b23d383a5f458b6e\SplashScreen.bmp
Filesize
117KB

MD5
bc32088bfaa1c76ba4b56639a2dec592

SHA1
84b47aa37bda0f4cd196bd5f4bd6926a594c5f82

SHA256
b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7

SHA512
4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830

Download Submit
F:\4ce83b6887b23d383a5f458b6e\UiInfo.xml
Filesize
63KB

MD5
c99059acb88a8b651d7ab25e4047a52d

SHA1
45114125699fa472d54bc4c45c881667c117e5d4

SHA256
b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d

SHA512
b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b

Download Submit
F:\4ce83b6887b23d383a5f458b6e\sqmapi.dll
Filesize
221KB

MD5
6404765deb80c2d8986f60dce505915b

SHA1
e40e18837c7d3e5f379c4faef19733d81367e98f

SHA256
b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120

SHA512
a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba

Download Submit
memory/248-247-0x000000001CE30000-0x000000001CED6000-memory.dmp

Filesize
664KB

Download
memory/248-245-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/248-243-0x000000001B1D0000-0x000000001B26C000-memory.dmp

Filesize
624KB

Download
memory/248-242-0x000000001B890000-0x000000001BD5E000-memory.dmp

Filesize
4.8MB

Download
memory/1464-211-0x000000001C030000-0x000000001C03A000-memory.dmp

Filesize
40KB

Download
memory/1464-192-0x00000000005D0000-0x0000000000612000-memory.dmp

Filesize
264KB

Download
memory/2268-246-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/2268-222-0x0000000005BF0000-0x0000000006196000-memory.dmp

Filesize
5.6MB

Download
memory/2268-221-0x00000000055A0000-0x000000000563C000-memory.dmp

Filesize
624KB

Download
memory/2268-228-0x0000000005780000-0x0000000005812000-memory.dmp

Filesize
584KB

Download
memory/2268-213-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3104-653-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3104-655-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3684-224-0x000002A644130000-0x000002A644144000-memory.dmp

Filesize
80KB

Download
memory/3684-210-0x000002A627530000-0x000002A628E5A000-memory.dmp

Filesize
25.2MB

Download
memory/3684-215-0x000002A6435B0000-0x000002A643802000-memory.dmp

Filesize
2.3MB

Download
memory/3684-219-0x000002A643800000-0x000002A6439F4000-memory.dmp

Filesize
2.0MB

Download
memory/3684-223-0x000002A643FE0000-0x000002A64412E000-memory.dmp

Filesize
1.3MB

Download
memory/4632-244-0x0000022CF9DC0000-0x0000022CFA3A8000-memory.dmp

Filesize
5.9MB

Download