Extracted

Extracted

• • Target
    Debug/EAX Console.exe
  • Size 2.0MB
  • SHA256 67f4ee97a3b3cc90ebc82b2f9fe49f84c8c1099c81061ddc8d30bc3b6cd1e587
  • MD5 40a2fd8c7f902b9720ea9c9d6f1d1378
  • SHA1 bcacdcf72f283098fa5f3b9f234113aa5175f2a6
  • SHA512 afec05d1ee88573e71220862181c62e78f92520694dceec96776087e6f4ae1eab07ddb0074598309b89556cf9071c4245bd11a23b5bd11ae7b559dfe72f8cdbe
  • SSDEEP 49152:WsCKIuxgaMj3XRD+uj3H2Cuk1+Lda3WvhoUo5c0XWzoZsCKBmL:WsCKIkDMj3XZ+ujX2Cuk1+Lda3Wvho6C
  • TLSH
    T1E79538D2EA4482D5ED3E47B3B0275CF116A33C7EEAF4649D248DB92649B3253442F81B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneptuneratumbralpersistenceprivilege_escalationspywarestealertrojan

  • Detects NeptuneRAT stealer

  • Detects Umbral payload

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Debug/Guna.UI2.dll
  • Size 2.1MB
  • SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
  • MD5 58459aefb74d5ff786b9efb982d44eab
  • SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
  • SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
  • SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
  • TLSH
    T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Debug/Melanchall.DryWetMidi.dll
  • Size 778KB
  • SHA256 ad4ac36ecd26a0dd9c79ed0fadd6a9a18fcbdef0032af22f083e9430e1c84e87
  • MD5 ed0dc7a819ba3e72503409b1bc3f7b66
  • SHA1 9e2ead3d137005dd19573f2695657eff3015bbf0
  • SHA512 b4709a51d7da713f1ae0828664f9dd622ad6f8740d0d0c9872f3ab54a9bd61d01fb7c9bdd1b24f012880f16e86034f2d0926c02c73276ddb1ac55ea5643db9f0
  • SSDEEP 12288:vwUNlhmD+rq4sdOuxyuD63PdQAdPYfFRvBR:vwUM+GC1uWPdG3BR
  • TLSH
    T19B05591237EC8E3BC6AF163BD570129963F0E846B393EB4B2314A6995D96B425C403F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Debug/Melanchall_DryWetMidi_Native32.dll
  • Size 56KB
  • SHA256 080346c638e219ec7cd4748e370e5e11931ed3a228c17f76d84c4d10ba9c9e6f
  • MD5 1b976d18b403ffb7d670b17a871bbfd4
  • SHA1 7e2022b1833f8ad6c4f4cc643d7068e013107ebd
  • SHA512 1b676ca71cba6ed2fc9952e46038eb891217a7960d7aa10b37dcb0f6230e30ab2e62d1e36faf7c783785c7874173dd29ab947e8bcd4be8c36cec7277a2340692
  • SSDEEP 384:ikfQAw+aLuu4N5ljtm8Xy9kjwJFP9TNaZFjnUmWw6w+e5XchXSvWZdTc2xv1Awo6:hft9RBi9kcfPmZFjHP5cJPDHthH
  • TLSH
    T18343A890BE844C9AE411B37854E5C167B63CB9D5C6031F0766286F35AB23BC13EDA27E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    Debug/Melanchall_DryWetMidi_Native64.dll
  • Size 65KB
  • SHA256 80ca89af931e43642a125ec82e253d9bd7002088d000daba6e0661cdad89f5aa
  • MD5 5326dfc6840947388f19f474c28e8c55
  • SHA1 81afe328f00c500a7138c16c2a0ef200e2a122e4
  • SHA512 4c0a1385438f26c1633c58c5e57f0f94ce704d8da52ec16f6111d2347e69cf8c0a3bdf9a4e737794110c02108ed70a4b65dec0ef67fca16d9103647e65a7ac5c
  • SSDEEP 768:STukqEi0unSZFjZe7+zZj2WuLGIC1FyOJJnD19UkG3JSTEUb:G3dun+jZeyYaIC1drGoTEUb
  • TLSH
    T1636350E12FD44C9BE925A23C52E6C232353CB9E447534B07963469321F13EC17EE9A9A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    Debug/Melanchall_DryWetMidi_Native64.dylib
  • Size 88KB
  • SHA256 aa08c542e77b045fa1e00d4feab21080ceb415c4b6c343b0dbc5704d1fb02f92
  • MD5 a51c6118f789a4f373ab25d98fab2988
  • SHA1 80eafcd0d5806bb6bc40600d418206b78f4240a4
  • SHA512 333a70512c919ec4119e9ce30364ad5380655f9105c60fdde4a29de600d54985bee73b02f498cd9a90d0ded58d9ea4d9eb1ba76f1879b595760d6b5174b2f647
  • SSDEEP 384:OwUiZX3J6yvvnVDytNa2ZHS60LuoM5W/pFA6Uxf9pVtjN/gDtgd/OC5zgtDH23Zh:Owd3CBUuL5WafVQ99W3PQdLj0
  • TLSH
    T14E93F9E36BC8561CC58B62B4C85101E2F435F81613E6461EF3DCAFA5EC197C82646EAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11
• • Target
    Debug/VoicemeeterRemote.dll
  • Size 162KB
  • SHA256 11270aad74acc080b1b55d568e7656961392da55323846ca5f12a9c765517d47
  • MD5 31f61fc1df546a5269d33825d829246b
  • SHA1 01c857cf99dc2a230ae84b386cbb49f794009d3b
  • SHA512 82d23f961ccec9470983d10b46e173dbe198b15f02d42fd11e4f7575ee9365ffe99913ce3d8d63aa7208409df3a0d1c0af49698584ae5aa10bdf1e7593b95bb9
  • SSDEEP 1536:iVv/5N7YkscWuY919UGxC35GTZQSon5kOE9AJolkjZfsG/z4fF6ZwT:iVv/5N0ksck919UCe58xGJoE0Gr4cwT
  • TLSH
    T195F3BE13768280F7D0A17ABC08E7773BEE3D559748968E039B64DE621D31752AB2720F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral12behavioral13
• • Target
    Debug/VoicemeeterRemote64.dll
  • Size 192KB
  • SHA256 69a24e80c96d2d557c6a0ce46cc0add1f62e252c613bccfa7f27833ca5345d87
  • MD5 281923b34fd8431f8c5d40398e6870de
  • SHA1 a6e4c6c2c42a3bf1ffbf7fd3bc42a12e1ec4a5f9
  • SHA512 c442736a91075ee15183e8b161a534343e0e96c15b034344c262e6731c80aeaa370e883d95fd1f426f7d92166127cfe3178bb3f58dd3214e36b27bf01814d940
  • SSDEEP 3072:FJg4AgTP9hAbB0zjlnOGfQ1OVKmTkSE0dSM1/jV6QgY6zaLJwu6:F+g/Ab5GfQ1ObTkSE0wUrl6gJm
  • TLSH
    T1ED149D4A329510FBE85B9238C9E36515FBB3B41213755BCF16A483721F277E26A3B321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral14behavioral15