Extracted

• • Target
    mns.exe
  • Size 1.1MB
  • SHA256 c836f1e0b97cc0dc3d8942ba1858590df48f227d75ab955ddea3b2921abe4b2f
  • MD5 3f1a6a648115ad71bd6e5adfb7d746a2
  • SHA1 2f1a9d7cf05e4646c2dc6381a09e5086e1bf6215
  • SHA512 453d8e4a00ddb903b06932321c64fe4ae791188598b8edf8fdc38d6235c75732d9472c8f85eae01372433225ef01db4ddbc46c3bc5f831437ddd58d455256eee
  • SSDEEP 12288:seCGDdog0ttPLmXGn3s78CSTGZPtAsA1cif/qYs82xl6kmp34duCDTX73L:XUBUTAqiHqYdpkmFCvLL
  • TLSH
    T1FF458D46F75391BDD52BC1758AAB1633F632B80C4135BB7F5A5487BA3F92B000628B27
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasionexecutiondonutloaderneptuneratloaderpersistencespywaretrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2