neptunerat | 5f87fc918059d9f4843170d9b261b2e3857a77f1d2eec8882f91cc70c31b1def

Analysis

user interaction
yes
max time kernel
20s
max time network
23s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/07/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ient.exe
Size 48KB
Sample260721-eg7ataes6l
SHA256 5f87fc918059d9f4843170d9b261b2e3857a77f1d2eec8882f91cc70c31b1def
MD5 76555591aaf95bd46c67e5b6279c7224
SHA1 e970125522e297b5cd48c7e13adf0b74591514a5
SHA512 4a62076f2b02cf04353482e45b12756137bbeb8389d36cfd3d88d5daa64e74d89661b9a1cfb3faccf4acf436d962cfedad5c9c9e02c52647922c8d3f9d7e84a6
SSDEEP 768:82UPAbKeAwgLFszXeciBAsH8Ny6is8bJnjoRRHbNWCybQTbtVWiSaAbhLOb8bMV:82UPAbKjT+LeciBAsH8Nn8bJnjehNWVG
TLSH
T14D23C69CB3D84131D4BE5AB21E77024893B4BAA38466D69F7CC401DE2B16B85C781EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

82.47.101.128:912

Attributes

filename
MasonUSB.exe
group
MasonGroup
key
sbmRAeBW16cEDAby
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/548-0-0x0000000000570000-0x0000000000582000-memory.dmp	family_neptunerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	5ient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3036	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4468	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	5ient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1036	548	5ient.exe	91
PID 548 wrote to memory of 3036	548	5ient.exe	93
PID 3036 wrote to memory of 4468	3036	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5ient.exe
"C:\Users\Admin\AppData\Local\Temp\5ient.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "5ient"
  2⤵
  PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7318.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7318.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7318.tmp.bat
Size 157B
SHA256 33bdd4f2b77db6d3ce86b12dc8ff7f7b3fdbd43e379c1302923c13443e4ba1af
MD5 3f2d902e1f56bcc942f3eefa1c787301
SHA1 bd9db3edb04eb4a2e4f587f1b665ce8ad5f6e266
SHA512 f834c5a2deed687e49937a8a3001ae077e252f54fb9f622e7b84f0961f50603ee04baa5fd0ade02a90da147a8ed278bcaf4e21dc36591b3187197cd9cec48037
TLSH
T1B6C08C0054CAFB0A290A281701B6C0DDE0775C1A3E447FA09758840CA88045CF8B9709
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-0-0x0000000000570000-0x0000000000582000-memory.dmp

Download

memory/548-1-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/548-2-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/548-3-0x0000000000EA0000-0x0000000000EAA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads