Extracted

• • Target
    kizo.exe
  • Size 84KB
  • SHA256 1971e5fc0bb89dcfc26a042c91d7ccb157ffa7a5877bce3f5f0f25d7b19dccea
  • MD5 593ed9a299bb11b0e4a664a702d4400a
  • SHA1 64b757126abe0ea93d7403745554f4e08b101644
  • SHA512 5ff827cbd7c28c7a28f0e2010b8fb2d43e278cc260a2ea409753ec40be1fa945529a7848f60f184f53b697cb559e95ad8826b0686948f405ad28c6c04afd5b77
  • SSDEEP 1536:FJ7XemSazAxq63OlqvsCMG9E8++AwmQVbrmtSNFVCqhfXSI2:rbegcxqRwUol9V9NfiI2
  • TLSH
    T17483E1D09CAF68DDD9E9C7F11BE0AB41374B7502CC092A05C2657BFFAEB3610989D921
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderneptuneratloaderpersistencetrojandefense_evasiondiscoveryransomwarespywarestealerbootkit

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3