Extracted

• • Target
    DXCore.exe
  • Size 1.6MB
  • SHA256 39fc98fdcdb31109e00fe600c49bd5c91f4ac61c2914717ff7e65047b2adf37c
  • MD5 f08b682109eabe7570e527a890e6c1ca
  • SHA1 f630a8bd8a48589db0fab6f29e8b768df9108d99
  • SHA512 84c34124ca003d5c3c5220a3478e4dd3aa45648559161ad9a8d72682a0f7c3b92487050af2580cb1c7575f7d2759e2470c4ba78701dd589742141b894dd1b5a3
  • SSDEEP 24576:xL4ey+/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:GCTFylhjactTgl8F
  • TLSH
    T13485492439FB501AB273EFA64BE479EADA6FB6333B07646D105103864723981DDC163E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistenceprivilege_escalationtrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1