neptunerat | aea374e7081e8ffc5f1f0a93dcbde19ce4ea28a001b8be124cddc0841dce3103

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OctopusEAX.exe
Size 1.5MB
Sample261023-3fpalsew2v
SHA256 aea374e7081e8ffc5f1f0a93dcbde19ce4ea28a001b8be124cddc0841dce3103
MD5 0599bd4bbf84839f36ec27e6f4fb7e73
SHA1 2b39a0b939b7a7c21a24861ce4107a67e605dcd1
SHA512 02e00147b3ae1fb0209a281e7498aa8a21bfedb29902e6caea7cdc2e905ceda9d1ab6cf793f8ba2f7db2487a56467bb78a0d07964b8a5021916735166a5a902e
SSDEEP 24576:Aap1R6cTZsO6T2yDOGTzgDhyFzbJ55hseB4sStsVLqsoqorv3fdPx:A4sDzZGhAzt5/LSrbsoqorX1x
TLSH
T14775221AA0EC719EF4B6FA3FC9CD3603EE4B0A11F4134348514E6E229D9C99545BBBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

adawdwadwwadwaodkwaida-44171.portmap.host:44171

Attributes

filename
USB.exe
group
MasonGroup
key
tH5KZZ2bOSg9Thku
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral1/files/0x000600000000d3f7-4.dat	family_neptunerat
behavioral1/memory/4212-13-0x0000000000F00000-0x0000000000F12000-memory.dmp	family_neptunerat

Executes dropped EXE 41 IoCs

pid	Process
4212	6745443343434343.exe
1652	6745443343434343.exe
5000	6745443343434343.exe
2752	6745443343434343.exe
2808	6745443343434343.exe
2244	6745443343434343.exe
1804	6745443343434343.exe
1004	6745443343434343.exe
1312	6745443343434343.exe
892	6745443343434343.exe
4284	6745443343434343.exe
2228	6745443343434343.exe
3892	6745443343434343.exe
2736	6745443343434343.exe
2128	6745443343434343.exe
4356	6745443343434343.exe
4388	6745443343434343.exe
1216	6745443343434343.exe
3816	6745443343434343.exe
1924	6745443343434343.exe
5024	6745443343434343.exe
648	6745443343434343.exe
2144	6745443343434343.exe
4280	6745443343434343.exe
4920	6745443343434343.exe
4396	6745443343434343.exe
652	6745443343434343.exe
4636	6745443343434343.exe
5080	6745443343434343.exe
1160	6745443343434343.exe
3244	6745443343434343.exe
2472	6745443343434343.exe
4856	6745443343434343.exe
376	6745443343434343.exe
2580	6745443343434343.exe
3804	6745443343434343.exe
4704	6745443343434343.exe
4792	6745443343434343.exe
1312	6745443343434343.exe
2448	6745443343434343.exe
2128	6745443343434343.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\6745443343434343 = "C:\\Users\\Admin\\AppData\\Roaming\\6745443343434343.exe"	6745443343434343.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\6745443343434343 = "C:\\Users\\Admin\\AppData\\Roaming\\6745443343434343.exe"	6745443343434343.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	6745443343434343.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6745443343434343.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6745443343434343.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6745443343434343.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6745443343434343.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3392	schtasks.exe
4604	schtasks.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	6745443343434343.exe
Token: SeDebugPrivilege	1652	6745443343434343.exe
Token: SeDebugPrivilege	5000	6745443343434343.exe
Token: SeDebugPrivilege	2752	6745443343434343.exe
Token: SeDebugPrivilege	2808	6745443343434343.exe
Token: SeDebugPrivilege	2244	6745443343434343.exe
Token: SeDebugPrivilege	1804	6745443343434343.exe
Token: SeDebugPrivilege	1004	6745443343434343.exe
Token: SeDebugPrivilege	1312	6745443343434343.exe
Token: SeDebugPrivilege	892	6745443343434343.exe
Token: SeDebugPrivilege	4284	6745443343434343.exe
Token: SeDebugPrivilege	2228	6745443343434343.exe
Token: SeDebugPrivilege	3892	6745443343434343.exe
Token: SeDebugPrivilege	2736	6745443343434343.exe
Token: SeDebugPrivilege	2128	6745443343434343.exe
Token: SeDebugPrivilege	4356	6745443343434343.exe
Token: SeDebugPrivilege	4388	6745443343434343.exe
Token: SeDebugPrivilege	1216	6745443343434343.exe
Token: SeDebugPrivilege	3816	6745443343434343.exe
Token: SeDebugPrivilege	1924	6745443343434343.exe
Token: SeDebugPrivilege	5024	6745443343434343.exe
Token: SeDebugPrivilege	648	6745443343434343.exe
Token: SeDebugPrivilege	2144	6745443343434343.exe
Token: SeDebugPrivilege	4280	6745443343434343.exe
Token: SeDebugPrivilege	4920	6745443343434343.exe
Token: SeDebugPrivilege	4396	6745443343434343.exe
Token: SeDebugPrivilege	652	6745443343434343.exe
Token: SeDebugPrivilege	4636	6745443343434343.exe
Token: SeDebugPrivilege	5080	6745443343434343.exe
Token: SeDebugPrivilege	1160	6745443343434343.exe
Token: SeDebugPrivilege	3244	6745443343434343.exe
Token: SeDebugPrivilege	2472	6745443343434343.exe
Token: SeDebugPrivilege	4856	6745443343434343.exe
Token: SeDebugPrivilege	376	6745443343434343.exe
Token: SeDebugPrivilege	2580	6745443343434343.exe
Token: SeDebugPrivilege	3804	6745443343434343.exe
Token: SeDebugPrivilege	4704	6745443343434343.exe
Token: SeDebugPrivilege	4792	6745443343434343.exe
Token: SeDebugPrivilege	1312	6745443343434343.exe
Token: SeDebugPrivilege	2448	6745443343434343.exe
Token: SeDebugPrivilege	2128	6745443343434343.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4060	1076	OctopusEAX.exe	82
PID 1076 wrote to memory of 4212	1076	OctopusEAX.exe	83
PID 4212 wrote to memory of 3392	4212	6745443343434343.exe	84
PID 4060 wrote to memory of 3332	4060	OctopusEAX.exe	86
PID 4060 wrote to memory of 1652	4060	OctopusEAX.exe	87
PID 3332 wrote to memory of 4516	3332	OctopusEAX.exe	89
PID 3332 wrote to memory of 5000	3332	OctopusEAX.exe	90
PID 4516 wrote to memory of 4548	4516	OctopusEAX.exe	91
PID 4516 wrote to memory of 2752	4516	OctopusEAX.exe	92
PID 4548 wrote to memory of 1460	4548	OctopusEAX.exe	94
PID 4548 wrote to memory of 2808	4548	OctopusEAX.exe	95
PID 1460 wrote to memory of 4816	1460	OctopusEAX.exe	97
PID 1460 wrote to memory of 1804	1460	OctopusEAX.exe	98
PID 4816 wrote to memory of 1600	4816	OctopusEAX.exe	99
PID 4816 wrote to memory of 1004	4816	OctopusEAX.exe	100
PID 1600 wrote to memory of 4056	1600	OctopusEAX.exe	101
PID 1600 wrote to memory of 1312	1600	OctopusEAX.exe	163
PID 4056 wrote to memory of 3624	4056	OctopusEAX.exe	103
PID 4056 wrote to memory of 892	4056	OctopusEAX.exe	135
PID 3624 wrote to memory of 3608	3624	OctopusEAX.exe	105
PID 3624 wrote to memory of 4284	3624	OctopusEAX.exe	106
PID 3608 wrote to memory of 768	3608	OctopusEAX.exe	107
PID 3608 wrote to memory of 2228	3608	OctopusEAX.exe	108
PID 768 wrote to memory of 2284	768	OctopusEAX.exe	109
PID 768 wrote to memory of 3892	768	OctopusEAX.exe	110
PID 2284 wrote to memory of 4716	2284	OctopusEAX.exe	111
PID 2284 wrote to memory of 2736	2284	OctopusEAX.exe	112
PID 4716 wrote to memory of 400	4716	OctopusEAX.exe	113
PID 4716 wrote to memory of 2128	4716	OctopusEAX.exe	114
PID 400 wrote to memory of 3448	400	OctopusEAX.exe	115
PID 400 wrote to memory of 4356	400	OctopusEAX.exe	116
PID 3448 wrote to memory of 2188	3448	OctopusEAX.exe	117
PID 3448 wrote to memory of 4388	3448	OctopusEAX.exe	118
PID 2188 wrote to memory of 4940	2188	OctopusEAX.exe	119
PID 2188 wrote to memory of 1216	2188	OctopusEAX.exe	120
PID 4940 wrote to memory of 4104	4940	OctopusEAX.exe	121
PID 4940 wrote to memory of 3816	4940	OctopusEAX.exe	122
PID 4104 wrote to memory of 2880	4104	OctopusEAX.exe	123
PID 4104 wrote to memory of 1924	4104	OctopusEAX.exe	124
PID 2880 wrote to memory of 2460	2880	OctopusEAX.exe	125
PID 2880 wrote to memory of 5024	2880	OctopusEAX.exe	126
PID 2460 wrote to memory of 3516	2460	OctopusEAX.exe	127
PID 2460 wrote to memory of 648	2460	OctopusEAX.exe	156
PID 3516 wrote to memory of 2740	3516	OctopusEAX.exe	129
PID 3516 wrote to memory of 2144	3516	OctopusEAX.exe	130
PID 2740 wrote to memory of 3232	2740	OctopusEAX.exe	131
PID 2740 wrote to memory of 4280	2740	OctopusEAX.exe	132
PID 3232 wrote to memory of 5116	3232	OctopusEAX.exe	133
PID 3232 wrote to memory of 4920	3232	OctopusEAX.exe	134
PID 5116 wrote to memory of 892	5116	OctopusEAX.exe	135
PID 5116 wrote to memory of 4396	5116	OctopusEAX.exe	136
PID 892 wrote to memory of 1696	892	OctopusEAX.exe	137
PID 892 wrote to memory of 652	892	OctopusEAX.exe	138
PID 1696 wrote to memory of 4664	1696	OctopusEAX.exe	139
PID 1696 wrote to memory of 4636	1696	OctopusEAX.exe	140
PID 4664 wrote to memory of 2004	4664	OctopusEAX.exe	141
PID 4664 wrote to memory of 5080	4664	OctopusEAX.exe	142
PID 2004 wrote to memory of 4988	2004	OctopusEAX.exe	143
PID 2004 wrote to memory of 1160	2004	OctopusEAX.exe	144
PID 4988 wrote to memory of 4568	4988	OctopusEAX.exe	145
PID 4988 wrote to memory of 3244	4988	OctopusEAX.exe	146
PID 4568 wrote to memory of 4036	4568	OctopusEAX.exe	147
PID 4568 wrote to memory of 2472	4568	OctopusEAX.exe	148
PID 4036 wrote to memory of 4756	4036	OctopusEAX.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
"C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
  "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
    "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
      "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        33⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        34⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        35⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        36⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        37⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        38⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
        39⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
      "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
    "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
  "C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "6745443343434343" /tr "C:\Users\Admin\AppData\Roaming\6745443343434343.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392

C:\Users\Admin\AppData\Roaming\6745443343434343.exe
C:\Users\Admin\AppData\Roaming\6745443343434343.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Users\Admin\AppData\Roaming\6745443343434343.exe
C:\Users\Admin\AppData\Roaming\6745443343434343.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Users\Admin\AppData\Roaming\6745443343434343.exe
C:\Users\Admin\AppData\Roaming\6745443343434343.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2128
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "6745443343434343" /tr "C:\Users\Admin\AppData\Roaming\6745443343434343.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OctopusEAX.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OctopusEAX.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

6745443343434343.exe

Path C:\Users\Admin\AppData\Local\Temp\6745443343434343.exe
Size 48KB
SHA256 7d04d4639eb87cce01eed81ffa16605dc0fe9070720da3ac8045319624226489
MD5 57e55fe6fabdaf672fb73c36719b3a6a
SHA1 f05e1b71398697a8f792677b85f9faeec6cc477d
SHA512 a639e85f4fa06e455ca3570a08f2b5d6aa54045a22cee269e30abd7d7de06ad76c098c88a41ec89c54748b329c347b74be52892b3a6eb4b7e020c4b0ac586f65
SSDEEP 1536:+O85FDtU7YHUVU6COUHaEtOVXOcSXOcVXOcNXOcIXOc8BuRUOuUk+PmVVm0XOcps:+N5FDtU7YHUVU6COU6EtOVXOcSXOcVXi
TLSH
T1A023F88DE7D51121D6BF6EB119B34249C7B06AD34817C62F6CD801CB2B27B988681FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-0-0x0000000000210000-0x0000000000394000-memory.dmp

Download

memory/4212-13-0x0000000000F00000-0x0000000000F12000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads