Extracted

Extracted

• • Target
    RuntimeBroker.exe
  • Size 2.8MB
  • SHA256 4baf632199b6536dd6f9451794dfc27c3af05a1a5f3eba796611f931710a98aa
  • MD5 651c57630f013cc011f21093963ef284
  • SHA1 d861347efde38de2c74f0497af0f6aeed246d779
  • SHA512 29931fd7565685e31a61229c24cba6739c24b7d1151b67494a565faf55220e53410fe25f5f428d710ee3dc4b5b3d4df0eb7916de4e9b22e6aadc17e962bedc92
  • SSDEEP 49152:3ZwyUNIAYKeNC2ToLH0DkUkf7oE3beJ9rQLFgNkupu9QBDr:3ZuYKcTVCf7oE329r4g6TQ3
  • TLSH
    T199D5F151A9908456F2494F7DA8E3360C33F8B1F79376F69B6681E8B5FD823D3084998C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratxwormpersistencerattrojan

  • Detect Xworm Payload

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2