8ac32ae4d8c767998242ebaa84daaf881caa16389b258a384e1f22a1f5415f81

Analysis

user interaction
yes
max time kernel
129s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
NeptuneRAT V5.3.exe
Size 26.5MB
Sample260814-q13bracp71
SHA256 8ac32ae4d8c767998242ebaa84daaf881caa16389b258a384e1f22a1f5415f81
MD5 01df3e97de037c0e96b928cfef52d0ee
SHA1 c0dc73bdbecce88ed80d0e7c820406b81fdfaaa6
SHA512 08a031daaf0c604a1c3177132e43f0a900853165aac49b59d217079300d73eaec7c08cafa17585e8f8cb2cace52cefe2df243bd27547f3f1ac0b34b98b7a725c
SSDEEP 786432:yEZu/fxXUYv7fztbkLrUXsLgWf/8UNwdo9w:eX1tv7fJQU8LgW3go9
TLSH
T1D15733D7DA41EC52EC6307B551B3CEBD99BB5EF89430A61604E5FD23BA328870D0A9C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1908	powershell.exe
3004	powershell.exe
1688	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2448	MasonClient.exe
3384	MasonClient.exe
4532	MasonClient.exe
2400	PekaBoo.COM
5540	PekaBoo.COM
5916	PekaBoo.COM
1296	MBR2.exe
5476	TROLL5.exe
3512	TROLL2.exe
3584	MBR2.exe
668	TROLL5.exe
3796	TROLL2.exe
5960	MBR2.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
296	cmd.exe
4516	cmd.exe
1268	cmd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\MasonClient = "C:\\Users\\Admin\\AppData\\Roaming\\MasonClient.exe"	MasonClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\MasonClient = "C:\\Users\\Admin\\AppData\\Roaming\\MasonClient.exe"	MasonClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\MasonClient = "C:\\Users\\Admin\\AppData\\Roaming\\MasonClient.exe"	MasonClient.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MasonClient.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4516	cmd.exe
1268	cmd.exe
296	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3488	schtasks.exe
5184	schtasks.exe
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1908	powershell.exe
1908	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
1688	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeIncreaseQuotaPrivilege	1908	powershell.exe
Token: SeSecurityPrivilege	1908	powershell.exe
Token: SeTakeOwnershipPrivilege	1908	powershell.exe
Token: SeLoadDriverPrivilege	1908	powershell.exe
Token: SeSystemProfilePrivilege	1908	powershell.exe
Token: SeSystemtimePrivilege	1908	powershell.exe
Token: SeProfSingleProcessPrivilege	1908	powershell.exe
Token: SeIncBasePriorityPrivilege	1908	powershell.exe
Token: SeCreatePagefilePrivilege	1908	powershell.exe
Token: SeBackupPrivilege	1908	powershell.exe
Token: SeRestorePrivilege	1908	powershell.exe
Token: SeShutdownPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeSystemEnvironmentPrivilege	1908	powershell.exe
Token: SeRemoteShutdownPrivilege	1908	powershell.exe
Token: SeUndockPrivilege	1908	powershell.exe
Token: SeManageVolumePrivilege	1908	powershell.exe
Token: 33	1908	powershell.exe
Token: 34	1908	powershell.exe
Token: 35	1908	powershell.exe
Token: 36	1908	powershell.exe
Token: SeIncreaseQuotaPrivilege	1908	powershell.exe
Token: SeSecurityPrivilege	1908	powershell.exe
Token: SeTakeOwnershipPrivilege	1908	powershell.exe
Token: SeLoadDriverPrivilege	1908	powershell.exe
Token: SeSystemProfilePrivilege	1908	powershell.exe
Token: SeSystemtimePrivilege	1908	powershell.exe
Token: SeProfSingleProcessPrivilege	1908	powershell.exe
Token: SeIncBasePriorityPrivilege	1908	powershell.exe
Token: SeCreatePagefilePrivilege	1908	powershell.exe
Token: SeBackupPrivilege	1908	powershell.exe
Token: SeRestorePrivilege	1908	powershell.exe
Token: SeShutdownPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeSystemEnvironmentPrivilege	1908	powershell.exe
Token: SeRemoteShutdownPrivilege	1908	powershell.exe
Token: SeUndockPrivilege	1908	powershell.exe
Token: SeManageVolumePrivilege	1908	powershell.exe
Token: 33	1908	powershell.exe
Token: 34	1908	powershell.exe
Token: 35	1908	powershell.exe
Token: 36	1908	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeIncreaseQuotaPrivilege	3004	powershell.exe
Token: SeSecurityPrivilege	3004	powershell.exe
Token: SeTakeOwnershipPrivilege	3004	powershell.exe
Token: SeLoadDriverPrivilege	3004	powershell.exe
Token: SeSystemProfilePrivilege	3004	powershell.exe
Token: SeSystemtimePrivilege	3004	powershell.exe
Token: SeProfSingleProcessPrivilege	3004	powershell.exe
Token: SeIncBasePriorityPrivilege	3004	powershell.exe
Token: SeCreatePagefilePrivilege	3004	powershell.exe
Token: SeBackupPrivilege	3004	powershell.exe
Token: SeRestorePrivilege	3004	powershell.exe
Token: SeShutdownPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeSystemEnvironmentPrivilege	3004	powershell.exe
Token: SeRemoteShutdownPrivilege	3004	powershell.exe
Token: SeUndockPrivilege	3004	powershell.exe
Token: SeManageVolumePrivilege	3004	powershell.exe
Token: 33	3004	powershell.exe
Token: 34	3004	powershell.exe
Token: 35	3004	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2448	2968	NeptuneRAT V5.3.exe	89
PID 2448 wrote to memory of 1268	2448	MasonClient.exe	90
PID 1268 wrote to memory of 1376	1268	cmd.exe	92
PID 1268 wrote to memory of 1908	1268	cmd.exe	93
PID 2448 wrote to memory of 3488	2448	MasonClient.exe	95
PID 3384 wrote to memory of 296	3384	MasonClient.exe	99
PID 296 wrote to memory of 5032	296	cmd.exe	101
PID 296 wrote to memory of 3004	296	cmd.exe	102
PID 3384 wrote to memory of 5184	3384	MasonClient.exe	103
PID 4532 wrote to memory of 4516	4532	MasonClient.exe	107
PID 4516 wrote to memory of 3724	4516	cmd.exe	109
PID 4516 wrote to memory of 1688	4516	cmd.exe	110
PID 4532 wrote to memory of 1216	4532	MasonClient.exe	111
PID 4532 wrote to memory of 2400	4532	MasonClient.exe	113
PID 4532 wrote to memory of 5540	4532	MasonClient.exe	114
PID 4532 wrote to memory of 5916	4532	MasonClient.exe	115
PID 2400 wrote to memory of 1296	2400	PekaBoo.COM	116
PID 2400 wrote to memory of 5476	2400	PekaBoo.COM	117
PID 2400 wrote to memory of 3512	2400	PekaBoo.COM	118
PID 5540 wrote to memory of 3584	5540	PekaBoo.COM	119
PID 5540 wrote to memory of 668	5540	PekaBoo.COM	120
PID 5540 wrote to memory of 3796	5540	PekaBoo.COM	121
PID 5916 wrote to memory of 5960	5916	PekaBoo.COM	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NeptuneRAT V5.3.exe
"C:\Users\Admin\AppData\Local\Temp\NeptuneRAT V5.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Roaming\MasonClient.exe
  "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks system information in the registry
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5184

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\System32\chcp.com
    chcp 65001
    3⤵
    PID:3724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM
  "C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        
        PID:2132
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3512
- C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM
  "C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Executes dropped EXE
    PID:3584
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        
        PID:1680
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    PID:3796
- C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM
  "C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Executes dropped EXE
    PID:5960
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      PID:2844
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    PID:3300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
1⤵
PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 695f6f65c407304bcf79cc3d67600c693f802a5f1f7a2508318b97ae11c25c08
MD5 172cc24acf7f0da4ca4e4400aa41d51c
SHA1 ce3d2fd1d39469ecc49d45384ec88b4b1b19b4d1
SHA512 fbb3260346d82770c776fd24c3c73d00ac8ed4606836e1ca9dd730ec1de7d1803a4fe6bd99e6cb45a4247c3c4991db3792d3fa665da389aba4afd3b23c1b6a37
TLSH
T13E216733F3CC8615CC9A013A50CDAC1036BAC7DB90DEDFAB6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ca806a1f5fd6e74f8734231dd1dbb5d3e2ca5f380657945173a9d630b5918198
MD5 fd227450fb9649314a413dbe4f2c19d2
SHA1 1a1065b40c1fe722931f3d5dc16ec2400cd7f4a6
SHA512 9a2225e3f69fe0e37c665ac2fde0653859d866e32ddc1e4fe46515807442c9e22d5463499d499ec2c6bdfce438661f021e200934c234c062123048b3b0652f34
TLSH
T185216737F3CC8615CC9A003A50CDAC1036BACBDB90DEDF9B6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PekaBoo.COM

Path C:\Users\Admin\AppData\Local\Temp\PekaBoo.COM
Size 921KB
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vxhhmjyh.wkp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vxhhmjyh.wkp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-8b32efb3b8e675f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-8b32efb3b8e675f1.tmp
Size 4B
SHA256 0f778ce0a3bdbce9b8059c778c3a8110828f5119fccae89764ad3bd2c6d06d7b
MD5 79ad3069360600de2b8217e2c65aa0c3
SHA1 2d5dbf4bbd597704079087dfea92b83808b9b2f5
SHA512 ba22732980121309aa873a19d2dfeb22e8b6ee57fbb85e2fc98bf35fd7a2912106d81fbca68f218231b3f6d136ddda89935dc6879110fb39683eea1eca2c5d55
MD5 SHA1 SHA512

Submit Download

~msnDEV-8b32efb3b8e675f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-8b32efb3b8e675f1.tmp
Size 4B
SHA256 5e92e6b69859a29a3c58e4117f12b9b09c5f43033265c049d0ea2a4e4e3f2928
MD5 80306b9158d7f9b5b00bd2294bddac40
SHA1 85bc989f6f8ddf4273d358ed28248172d0d9848b
SHA512 05075ddab2cf94ae77a8e35f8920ed9a84bdff33892b4691cdba8b5953410146b10c35ee49e119d5d633915073d89de42d796078bad1fa8c6c98c2365157aa53
MD5 SHA1 SHA512

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 60KB
SHA256 0fcef677b297d9ff5a0d8256bf458ef1ba110ed67194a4a5c62caf619702582c
MD5 26b9f2bdd7393b9cbc5a8f89af868194
SHA1 8ca42e7c7f9e7b4fce2b3c3380b4c5d635c01890
SHA512 4d5a4c45a225141d18219cef009508fe02ef38e1e4147d0affa5be2a4d7044ab605a83f224a0ee3d03833ded1f8ae3d3984c1bc65810125eb5a449b8c10944a2
SSDEEP 768:0EYvmSD3hsX1h+Az5GOsUP4nhJVZmYm0BsWAfRxMOUNX7XTBuvJ1bx2ixXjAFrJw:FYvxrhs3z518JPDCkRNLT8vJhxXjmJw
TLSH
T14E53090AF39364ECC51BC67446EB6773BA32BD6511319F3E0794E6302E50E60AE79B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-134-0x00000000004C0000-0x00000000004FA000-memory.dmp

Download

memory/1908-28-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-38-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-27-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-26-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-32-0x000002086EED0000-0x000002086EF82000-memory.dmp

Download

memory/1908-31-0x000002086ECA0000-0x000002086ECBE000-memory.dmp

Download

memory/1908-33-0x000002086EC70000-0x000002086EC7A000-memory.dmp

Download

memory/1908-34-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-35-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-36-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-37-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-20-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-39-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-41-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-25-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-19-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-24-0x0000020856AA0000-0x0000020856AC2000-memory.dmp

Download

memory/1908-21-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/1908-18-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2400-106-0x0000000000C20000-0x0000000000D0C000-memory.dmp

Download

memory/2400-107-0x0000000002DC0000-0x0000000002EA4000-memory.dmp

Download

memory/2448-44-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/2968-4-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-3-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-8-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-17-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-2-0x0000000000770000-0x00000000021FE000-memory.dmp

Download

memory/2968-1-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-7-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2968-0-0x00007FFC3D47F000-0x00007FFC3D480000-memory.dmp

Download

memory/3004-51-0x0000018B7B7C0000-0x0000018B7B872000-memory.dmp

Download

memory/3300-182-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3384-53-0x000000030FE60000-0x000000030FEBA000-memory.dmp

Download

memory/3384-64-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/3384-67-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/3384-66-0x000000030FE60000-0x000000030FEBA000-memory.dmp

Download

memory/3384-70-0x000000030FE60000-0x000000030FEBA000-memory.dmp

Download

memory/3512-161-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3796-163-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4532-94-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-93-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-90-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-91-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-92-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-97-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-150-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-96-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4532-95-0x00007FF718170000-0x00007FF718189000-memory.dmp

Download

memory/4924-160-0x0000000000230000-0x0000000000276000-memory.dmp

Download

memory/5476-146-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Download

memory/5476-142-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Download

memory/5476-141-0x0000000005520000-0x0000000005ADA000-memory.dmp

Download

memory/5476-140-0x0000000000210000-0x00000000002C8000-memory.dmp

Download

memory/5772-180-0x0000000000820000-0x0000000000828000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads