Extracted

• • Target
    MOD N7R V2.bat
  • Size 97KB
  • SHA256 56065ae27dbe7d2ce81b0b6bf0ccfbcb4630291676acaa6aee44bb99e0a64cfb
  • MD5 2ed8c0052ccf9bc0fb5c9c7e36858e8f
  • SHA1 d90f5fa70358673cf53c7b8342bb823b6f768c33
  • SHA512 764e569ff58ecb146a4574e8c4c7b7d7a6f43d43d69c42f2189ca048ac5891fe881b2309440d64e7a0591ee365e244b658f7555e738d6bf784ef92d54254eb29
  • SSDEEP 3072:UnYJ5ZHfpgs6zpENBmaGC7G8A1SgOUaScR:UYXLv6sdGCBAEB
  • TLSH
    T1BFA30249667CEF33D48A76BD43A601D087B1C7328F0BEB6DAA4C29D0AC907508DD695F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderneptuneratloaderpersistencetrojanadwareransomwarespyware

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2