Extracted

• • Target
    Windows Updet2.exe
  • Size 85KB
  • SHA256 b70aa66d3f906a8866591e7ddd399dbb9f137de590180e256fee552b9ed8b8fe
  • MD5 6eb1119fe4d0bb696dfb7703f2120f06
  • SHA1 4e73bfa9515e8ffd4c6b2cb44171e1ac3550ab5e
  • SHA512 c378b7b8dee8b7386a01cba971807711b8cfb0bdd7fe8b50c1df1c833a43c78d9aae0038ebc251814374cc7b2c2b6592f6dbb9003ca637ce74f33a8bf21ae53a
  • SSDEEP 1536:A8R3aRraPGScjxEuhHQkMaVTA6A9bk/0HCLZTWJ88Bzx4ShDMZrhqPY1OTcNnRsF:A8r5cyuhHOkc6+kJLZTkREv9QWNM
  • TLSH
    T12683E112B3CAC969F8528D30614FC3308EFBE095840032BD6858CBA55DEC56DBDA27F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1