Extracted

• • Target
    Bypassed.exe
  • Size 1.9MB
  • SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
  • MD5 895088641b452ca046da55b8901462d7
  • SHA1 e1756aa09e0ead1a6ee58e9b409192043e614822
  • SHA512 0cc1108513076c1bac555d01ced27aae9d138d1463416fd056e459b967145f7b19f0e5e0e561ec12483484a874d204773a5170a494e550c29f0a5e29ce02fb7a
  • SSDEEP 49152:BMXA6xXZgFUd7gvy3XHHooAj3JJqrdrp9ZjXXkGE8AJ7gnX6cHIQS1eXApMbEJMy:
  • TLSH
    T11995A1141EEE181963B2AE6D5BD478DFC45EABA33B0710F614F2028E4711D93C9E27B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratpersistencetrojandefense_evasion

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2