Extracted

Extracted

• • Target
    servicebound.exe
  • Size 3.2MB
  • SHA256 94bc5733800b54d7ee5f22b874ed84cfccf041b90ba55b59aa731193fa9c638a
  • MD5 5802de01b89740761e60bb78b879b44f
  • SHA1 e6297382d44fd8e6f0e99a25bd0f47ca68a78902
  • SHA512 3c6543fba0f0082752e692b65e727263683b554c94cf31c2f7054dbd807daaf4c4613ccf46b33b51a94153a85026aa4feb77d5e2181ffe9f6aac06217d45e373
  • SSDEEP 24576:G9VHC672CPg2EdR6Bnbvb5r4DUhuLJnnxd1uUrkKt+q3PZz9a5V/1o9GiaH:GvCPaxeR6Bbd1ulnxd1lrkwDxy
  • TLSH
    T1C8F529243DFB501DB3B3AFA55FD8B8EF896FF6732A0A6469205103464723941DE8173A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionexecutionneptuneratxwormpersistencerattrojan

  • Detect Xworm Payload

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Stops running service(s)

    defense_evasionexecution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2