neptunerat | 06782e08ae567b3eecc1584d63d9b35f17963bee25c52f9030bf1a754fff9417

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Output.exe
Size 1.5MB
Sample261001-ndfs5assdv
SHA256 06782e08ae567b3eecc1584d63d9b35f17963bee25c52f9030bf1a754fff9417
MD5 5b5c1015f76c2a336614bb2de69b5a01
SHA1 c64a7a2279a93c8f8943b8406526b8a123ef53b4
SHA512 e613a4bbf64a0425185417dd2726731628ca5d5da8bbedb3204a43d3ae65ba646eaecd40dd09939702b6b7889e6de0a8aa35499d3c88b459a806a8af51c28386
SSDEEP 24576:a4RrvI1lPywj9XSypoyLz2Z4UsZcjAoEGyXYdV9kO20My4jOBWYhGkphINeZ:a4Ra/jkMzCsi5ETodVm91y46BWUgNs
TLSH
T11575224013D74636DA9F167A6A554C81620EE6FC14FFB8888A99FAF2B47BC1441FB10F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neptunerat trojan

Malware Config

Extracted

Family

neptunerat

efk-43863.portmap.host:43863

Attributes

filename
Epic Games Launcher.exe
group
MasonGroup
key
Ni71esu44sAj1tWl
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c50e-36.dat	family_neptunerat
behavioral2/memory/4432-50-0x0000000000710000-0x0000000000724000-memory.dmp	family_neptunerat

Executes dropped EXE 4 IoCs

pid	Process
5168	0x32.exe
1204	مكتبات بايثون كامله.exe
4072	a3w1ZV7WCd3H.exe
4432	Epic Games Launcher.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Epic Games Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Epic Games Launcher.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	Output.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	0x32.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	مكتبات بايثون كامله.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	Epic Games Launcher.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5704	OpenWith.exe
4584	OpenWith.exe
5272	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 5168	1868	Output.exe	89
PID 5168 wrote to memory of 1204	5168	0x32.exe	90
PID 5168 wrote to memory of 4072	5168	0x32.exe	91
PID 1204 wrote to memory of 4432	1204	مكتبات بايثون كامله.exe	94

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\0x32.exe
  "C:\Users\Admin\AppData\Local\Temp\0x32.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Users\Admin\AppData\Local\Temp\مكتبات بايثون كامله.exe
    "C:\Users\Admin\AppData\Local\Temp\مكتبات بايثون كامله.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Epic Games Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Epic Games Launcher.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\a3w1ZV7WCd3H.exe
    "C:\Users\Admin\AppData\Local\Temp\a3w1ZV7WCd3H.exe"
    3⤵
    - Executes dropped EXE
    PID:4072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0x32.exe

Path C:\Users\Admin\AppData\Local\Temp\0x32.exe
Size 1.5MB
SHA256 2f2e15e8b55d6a4f30d9d6fe3cb92c07597ba09208ce552b55f2c0df0534ec2c
MD5 d2006c0ffd7277d6583d2ea7c7fc3d93
SHA1 d23623061e64d3636ab117513989ed7b9adc6b5f
SHA512 f3ca6653bd8d965477c835b19238bc8d8daf46633e0c051ff9a903a56c01eeeb31c4bd5ad378a4cf9445620349113a618551b60771479873dfa10e8338d744f2
SSDEEP 24576:3AAvlmm+ZEaKEPdTuelqnf93pwocLPJCXsTdMmJayeLVfkS2wv5EHj1N7z58duTo:7NGZEtEFqelqnfJupLJCkMmJJ6Vfj2Kz
TLSH
T13A65120058DD75ECF639F6BB9ACD7803FEA36581F5238B69996E8E41CC1C112113B6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epic Games Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\Epic Games Launcher.exe
Size 55KB
SHA256 4d0c8fae30ae2ecd437cd3be90971e13d562f183be107839c15f9c3ed952c288
MD5 d9d9d322b94e87f268c00655790775ec
SHA1 d95c6e11401fc77f1a7e0b5b3c6415e7a8acca19
SHA512 58aa0720d99ddfdb0e3b8e9e3624401b0bf7b1e14896cce9a58581bdc4cc9c918c5890e66e5f8fbdfcd6ddd4dd37008cc47821b20237ef93c3207c6cfc24a759
SSDEEP 768:F2h5Pdob7RHvcC9zGNsPzLrQzijNoYb/to1fZXpBN89BGiphJOB2Kb6Ax:F2h5PdobZvcC1SPujNoYb/tkDObOb6e
TLSH
T12543E88AE7E94120C1BF5AB119F312098676E9976402CB0F7DD485DE2737B888592BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3w1ZV7WCd3H.exe

Path C:\Users\Admin\AppData\Local\Temp\a3w1ZV7WCd3H.exe
Size 1.4MB
SHA256 d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40
MD5 025c9c1d81a59636b571bdeb5771e88b
SHA1 1699b594612cb29084c10117dc17762ee94c2f78
SHA512 06fda7f365306f717cf328d56f4be0c8ee5f3752dc09d2d2dcaabdf225bed13e7a02478543aedb01cec47ea39d8d59a85939515066dadc37e951ec3c95c93139
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W
TLSH
T1CC65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

توكن.py

Path C:\Users\Admin\AppData\Local\Temp\توكن.py
Size 9KB
SHA256 ccae828399b23b7b5cac035f2e573b47bdc149d80b6766514e1218de360040b2
MD5 762596f5158ea9d02388722629784439
SHA1 2738bbfcb14d22c6a9d8455c6d62501f40e762b0
SHA512 b877163bb2a316e469f98de5a9aeea0cbf2ea0f1a078f9c37a527482b614e8bb144b6681839efc0db0e1745e1cf5db05aea13b70a586fb51614154733602843f
SSDEEP 192:4XQwEhBUvdTk+VZSGuhTDXErstKNNrH1WA/a/49MSqHGAuR7En:4XQLhBUvdTk+mNdD0UKNNrH1WA/T9MSc
TLSH
T13322EA7A8C032027C2BD458D8D12CE1EEB46958FA1075D237A7C56D86FF5C62A17AE3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

مكتبات بايثون كامله.exe

Path C:\Users\Admin\AppData\Local\Temp\مكتبات بايثون كامله.exe
Size 77KB
SHA256 a2e20ed96761be01fa3f934b1db1c629973f193009e16c20a769731033284214
MD5 d93a9714bdc99ff1b92fe5e4577cec11
SHA1 0d097faefe2af90d351e75eec24ca04d599b2c8c
SHA512 8aa56264a3223a3475854c6f5c20bd0174220c22018906697572abe81028910cd6021fde9b46c3cff3f12a84a0d32389717d452b612a92b18bfd641f53c3baf0
SSDEEP 1536:Gia/nyySjtoOC/nbEuMU/+nGfxDNCFJtejjkODdX8Z:4/nXSWOCjEuMU/+nDjqYg+Z
TLSH
T1EF73F16572D472EBFBFB4A321CE550212F12AA18F415EE0D524C6F92D9BE9044FB3A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-31-0x0000000000070000-0x000000000008A000-memory.dmp

Download

memory/1868-0-0x00007FFF31DEF000-0x00007FFF31DF0000-memory.dmp

Download

memory/1868-17-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/1868-3-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/1868-1-0x0000000000310000-0x0000000000490000-memory.dmp

Download

memory/4432-50-0x0000000000710000-0x0000000000724000-memory.dmp

Download

memory/4584-56-0x0000026A5B7E0000-0x0000026A5B842000-memory.dmp

Download

memory/5168-16-0x0000000000A80000-0x0000000000BFC000-memory.dmp

Download

memory/5272-57-0x000001E5F19E0000-0x000001E5F1A42000-memory.dmp

Download

memory/5704-55-0x0000026C35470000-0x0000026C354D2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads