neptunerat | 0bdd762d663355e0b4ce4fa047b288677d9356d18bac89fca0d53eb9102c2bdd

General

Target
svchostt.exe
Size 49KB
Sample261113-yvanjsfs4l
SHA256 0bdd762d663355e0b4ce4fa047b288677d9356d18bac89fca0d53eb9102c2bdd
MD5 22406c09bc3624ff98146c33be250d78
SHA1 31122c9c0159c7a72cf24934da5fd9a8ee3b47f4
SHA512 f889e2cb1d3f1a365bc882b3fc158b8fd2f5079b55a27660355e48b16ed22f6648cef47f652907d36e689785951f3b54107d2d2d7fe186d0dda86e96e6a8b727
SSDEEP 1536:KtwHE32StU8DGU7UIX3UZkXLTZnXOccXOcjXOcAXOcVXOcKhYlUOeUk+4mFVmnga:KyHE32StU8DGU7UIX3USXLTZnXOccXO4
TLSH
T10B33D78DE7D50121C6BF5EB219B31219C3B076D34916C62F7CD805CB2B2BB988685BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

C2

5.tcp.cpolar.cn:14164

Attributes

filename
USB.exe
group
MasonGroup
key
sD0GMEyJQOgqQ8xw
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral3/memory/5076-0-0x0000000000B60000-0x0000000000B72000-memory.dmp	family_neptunerat
behavioral3/files/0x002900000002b0bb-3.dat	family_neptunerat

Executes dropped EXE 3 IoCs

pid	Process
3772	svchostt.exe
772	svchostt.exe
1268	svchostt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchostt = "C:\\Users\\Admin\\AppData\\Roaming\\svchostt.exe"	svchostt.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	svchostt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchostt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchostt.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2284	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	svchostt.exe
Token: SeDebugPrivilege	3772	svchostt.exe
Token: SeDebugPrivilege	772	svchostt.exe
Token: SeDebugPrivilege	1268	svchostt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2284	5076	svchostt.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchostt.exe
"C:\Users\Admin\AppData\Local\Temp\svchostt.exe"
1⤵
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svchostt" /tr "C:\Users\Admin\AppData\Roaming\svchostt.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2284

C:\Users\Admin\AppData\Roaming\svchostt.exe
C:\Users\Admin\AppData\Roaming\svchostt.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Users\Admin\AppData\Roaming\svchostt.exe
C:\Users\Admin\AppData\Roaming\svchostt.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Users\Admin\AppData\Roaming\svchostt.exe
C:\Users\Admin\AppData\Roaming\svchostt.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Video Capture

1

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchostt.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchostt.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

svchostt.exe

Path C:\Users\Admin\AppData\Roaming\svchostt.exe
Size 49KB
SHA256 0bdd762d663355e0b4ce4fa047b288677d9356d18bac89fca0d53eb9102c2bdd
MD5 22406c09bc3624ff98146c33be250d78
SHA1 31122c9c0159c7a72cf24934da5fd9a8ee3b47f4
SHA512 f889e2cb1d3f1a365bc882b3fc158b8fd2f5079b55a27660355e48b16ed22f6648cef47f652907d36e689785951f3b54107d2d2d7fe186d0dda86e96e6a8b727
SSDEEP 1536:KtwHE32StU8DGU7UIX3UZkXLTZnXOccXOcjXOcAXOcVXOcKhYlUOeUk+4mFVmnga:KyHE32StU8DGU7UIX3USXLTZnXOccXO4
TLSH
T10B33D78DE7D50121C6BF5EB219B31219C3B076D34916C62F7CD805CB2B2BB988685BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5076-0-0x0000000000B60000-0x0000000000B72000-memory.dmp

Download

memory/5076-2-0x000000001CF30000-0x000000001CF40000-memory.dmp

Download

memory/5076-6-0x000000001CF30000-0x000000001CF40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads