301b188f613df413fd830d89617719907f3446ba9bc5f9d9a66b16ea64d0905d

Analysis

max time kernel
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NeptuneRAT-Cracked.exe
Size 26.4MB
Sample260604-cvcl9agy9x
SHA256 301b188f613df413fd830d89617719907f3446ba9bc5f9d9a66b16ea64d0905d
MD5 94807c893f2944d963ff392d0ec05c47
SHA1 817f093b263d7306b83dc1184285e7c283749bb4
SHA512 f245f45cdbfb1391e6094c2d52fc4121a48b256fe02c0e73381e3c644cd44ce9d27e00d65ca48965661c1f406716199438b19feb23b3a67310f7d6ed4a44b59c
SSDEEP 786432:dLV67p5Hjjsp4PPXOwy47U435USQXw7Mb:dpmptA4PWwrU4ujH
TLSH
T1CD573338E77815ABD0A79237C851E315AF2171C4EB81E54706F46CA33C2B6A2FDB96C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4520	System.Data.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4776	4520	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.Data.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4520	2440	NeptuneRAT-Cracked.exe	82

C:\Users\Admin\AppData\Local\Temp\NeptuneRAT-Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\NeptuneRAT-Cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\System.Data.exe
  "C:\Users\Admin\AppData\Local\Temp\System.Data.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 904
    3⤵
    - Program crash
    PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 4520
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.Data.exe

Path C:\Users\Admin\AppData\Local\Temp\System.Data.exe
Size 29.5MB
SHA256 7145107da0809953dc99ec4c45997aaef05f8c697d67860c712ffb304dc430aa
MD5 310bae12b4b93dc5c5c43bea31de062f
SHA1 4dfe10b4b347a2e681096a8178e10032be29955b
SHA512 c91dab1641f0bb01423320d7c1441102459eb73bb046822e900d6006b320cdfe3a756d6c5ec0cd9a9346b3f6cd0d18cd161d2b65598e3bcb5ddcf5e3638c603c
SSDEEP 786432:3Tbc9s8vao5ZLXRuNvb3GQBleQk/HojRMYIqgho:3Tb+s8vPL8Z7GQjjoI1Mjqgu
TLSH
T131672217FA81AE74E57E4CF24423664042D5D31E8E2D89FA367936E923F11E27601FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4520-14-0x0000000000C00000-0x000000000297E000-memory.dmp

Download

memory/4520-15-0x0000000007B10000-0x00000000080B6000-memory.dmp

Download

memory/4520-16-0x0000000007520000-0x00000000075B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads