Extracted

• • Target
    dwe.exe
  • Size 48KB
  • SHA256 38d73d1de4016d76d82ed62ba16ee905b05861c006146f65c1274dc0001f2561
  • MD5 800149e7b36ad1c89f347aff36f35bb9
  • SHA1 e48337a083fb37d8397b46751807013e32729569
  • SHA512 e875aae1c850ce05a120fbcc4741fbd4ae251f5dca36a74c59dd4c13acb65cb4459a25156f93ee2871464d3eef959a9252af06e7dbd0427055fe3d7af32645dc
  • SSDEEP 1536:MaBVj0PftUOfvUdU+u2U3Dz4YFMGjXOcQXOcrXOcBXOcAXOcWVSuUOiUk+PmieoE:MaBVAPftUOfvUdU+u2Uzz4YFMGjXOcQS
  • TLSH
    T14423D68DE7D50121D6BF5EB119B35248C3B06AD38816C66F7CD805DB2B2BB984681FE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneptuneratpersistencetrojanbootkit

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1behavioral2behavioral3