Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Neptune Player' = '"%ProgramFiles%\Neptune Player\Neptune Player.exe"'
Malicious functions
Injects code into
the following user processes:
- neptune player.exe
Modifies file system
Creates the following files
- %TEMP%\nshfb02.tmp\system.dll
- %APPDATA%\neptune player\gpucache\index
- %APPDATA%\neptune player\code cache\js\index
- %TEMP%\neptune player crashes\crashpadmetrics-active.pma
- %TEMP%\neptune player crashes\settings.dat
- %TEMP%\nshfb02.tmp\inetc.dll
- C:\users\public\desktop\neptune player.lnk
- %TEMP%\nshfb02.tmp\winshell.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\neptune player.lnk
- %ProgramFiles%\neptune player\uninstall neptune player.exe
- %LOCALAPPDATA%\neptune-player-updater\installer.exe
- %ProgramFiles%\neptune player\vk_swiftshader.dll
- %ProgramFiles%\neptune player\swiftshader\libglesv2.dll
- %ProgramFiles%\neptune player\locales\vi.pak
- %ProgramFiles%\neptune player\swiftshader\libegl.dll
- %ProgramFiles%\neptune player\neptune player.exe
- %ProgramFiles%\neptune player\libglesv2.dll
- %ProgramFiles%\neptune player\libegl.dll
- %ProgramFiles%\neptune player\ffmpeg.dll
- %ProgramFiles%\neptune player\d3dcompiler_47.dll
- %ProgramFiles%\neptune player\vk_swiftshader_icd.json
- %ProgramFiles%\neptune player\v8_context_snapshot.bin
- %ProgramFiles%\neptune player\snapshot_blob.bin
- %ProgramFiles%\neptune player\resources\app.asar
- %ProgramFiles%\neptune player\resources\app-update.yml
- %ProgramFiles%\neptune player\resources.pak
- %ProgramFiles%\neptune player\locales\zh-tw.pak
- %ProgramFiles%\neptune player\resources\elevate.exe
- %ProgramFiles%\neptune player\locales\zh-cn.pak
- %APPDATA%\neptune player\gpucache\data_0
- %APPDATA%\neptune player\de39a105-374c-48a9-aae0-f4a45bb1bdce.tmp
- %APPDATA%\neptune player\795fd7e5-256c-4f1a-a617-5d9312dc730e.tmp
- %APPDATA%\neptune player\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\neptune player\neptune-player.db
- %APPDATA%\neptune player\neptune-player.db-journal
- %TEMP%\86305542-d53f-4887-bb88-2be9fec6eee4.tmp.node
- %APPDATA%\neptune player\00ed1760-b2ed-40c6-ae22-241e55aac2c8.tmp
- %APPDATA%\neptune player\en-us-8-0.bdic
- %APPDATA%\neptune player\local storage\leveldb\log
- %APPDATA%\neptune player\local storage\leveldb\000001.dbtmp
- %APPDATA%\neptune player\local storage\leveldb\manifest-000001
- %APPDATA%\neptune player\cache\f_000002
- %APPDATA%\neptune player\dictionaries\en-us-8-0.bdic
- %APPDATA%\neptune player\gpucache\data_2
- %APPDATA%\neptune player\gpucache\data_1
- %APPDATA%\neptune player\cookies
- %APPDATA%\neptune player\cookies-journal
- %APPDATA%\neptune player\.updaterid
- %APPDATA%\neptune player\logs\2022-03-25.main.log
- %APPDATA%\neptune player\cache\data_3
- %APPDATA%\neptune player\cache\data_2
- %APPDATA%\neptune player\cache\data_1
- %APPDATA%\neptune player\cache\data_0
- %APPDATA%\neptune player\cache\index
- %APPDATA%\neptune player\code cache\js\index-dir\temp-index
- %APPDATA%\neptune player\sentry\scope_v2.json
- %APPDATA%\neptune player\gpucache\data_3
- %APPDATA%\neptune player\cache\f_000001
- %ProgramFiles%\neptune player\locales\uk.pak
- %ProgramFiles%\neptune player\locales\tr.pak
- %ProgramFiles%\neptune player\locales\th.pak
- %ProgramFiles%\neptune player\locales\fa.pak
- %ProgramFiles%\neptune player\locales\et.pak
- %ProgramFiles%\neptune player\locales\es.pak
- %ProgramFiles%\neptune player\locales\es-419.pak
- %ProgramFiles%\neptune player\locales\en-us.pak
- %ProgramFiles%\neptune player\locales\en-gb.pak
- %ProgramFiles%\neptune player\locales\el.pak
- %ProgramFiles%\neptune player\locales\de.pak
- %ProgramFiles%\neptune player\locales\da.pak
- %ProgramFiles%\neptune player\locales\cs.pak
- %ProgramFiles%\neptune player\locales\ca.pak
- %ProgramFiles%\neptune player\locales\fil.pak
- %ProgramFiles%\neptune player\locales\bn.pak
- %ProgramFiles%\neptune player\locales\ar.pak
- %ProgramFiles%\neptune player\locales\am.pak
- %ProgramFiles%\neptune player\licenses.chromium.html
- %ProgramFiles%\neptune player\license.electron.txt
- %ProgramFiles%\neptune player\icudtl.dat
- %ProgramFiles%\neptune player\chrome_200_percent.pak
- %ProgramFiles%\neptune player\chrome_100_percent.pak
- %TEMP%\nshfb02.tmp\nsis7z.dll
- %TEMP%\nshfb02.tmp\app-64.7z
- %TEMP%\nshfb02.tmp\nsprocess.dll
- %TEMP%\nshfb02.tmp\spiderbanner.dll
- %TEMP%\nshfb02.tmp\stdutils.dll
- %ProgramFiles%\neptune player\locales\bg.pak
- %ProgramFiles%\neptune player\locales\fr.pak
- %ProgramFiles%\neptune player\locales\fi.pak
- %ProgramFiles%\neptune player\locales\gu.pak
- %ProgramFiles%\neptune player\locales\te.pak
- %ProgramFiles%\neptune player\locales\nb.pak
- %ProgramFiles%\neptune player\locales\ta.pak
- %ProgramFiles%\neptune player\locales\sw.pak
- %ProgramFiles%\neptune player\locales\sv.pak
- %ProgramFiles%\neptune player\locales\sr.pak
- %ProgramFiles%\neptune player\locales\sl.pak
- %ProgramFiles%\neptune player\locales\sk.pak
- %ProgramFiles%\neptune player\locales\ru.pak
- %ProgramFiles%\neptune player\locales\ro.pak
- %ProgramFiles%\neptune player\locales\pt-pt.pak
- %ProgramFiles%\neptune player\locales\pt-br.pak
- %ProgramFiles%\neptune player\locales\pl.pak
- %ProgramFiles%\neptune player\locales\nl.pak
- %ProgramFiles%\neptune player\locales\ms.pak
- %ProgramFiles%\neptune player\locales\he.pak
- %ProgramFiles%\neptune player\locales\mr.pak
- %ProgramFiles%\neptune player\locales\ml.pak
- %ProgramFiles%\neptune player\locales\lv.pak
- %ProgramFiles%\neptune player\locales\lt.pak
- %ProgramFiles%\neptune player\locales\ko.pak
- %ProgramFiles%\neptune player\locales\kn.pak
- %ProgramFiles%\neptune player\locales\ja.pak
- %ProgramFiles%\neptune player\locales\it.pak
- %ProgramFiles%\neptune player\locales\id.pak
- %ProgramFiles%\neptune player\locales\hu.pak
- %ProgramFiles%\neptune player\locales\hr.pak
- %ProgramFiles%\neptune player\locales\hi.pak
- %APPDATA%\neptune player\4bc6337f-b030-4d02-a95a-5cfb17e38dff.tmp
- %APPDATA%\neptune player\local storage\leveldb\000003.log
Deletes the following files
- %TEMP%\nshfb02.tmp\app-64.7z
- %TEMP%\nshfb02.tmp\inetc.dll
- %TEMP%\nshfb02.tmp\nsis7z.dll
- %TEMP%\nshfb02.tmp\nsprocess.dll
- %TEMP%\nshfb02.tmp\spiderbanner.dll
- %TEMP%\nshfb02.tmp\stdutils.dll
- %TEMP%\nshfb02.tmp\system.dll
- %TEMP%\nshfb02.tmp\winshell.dll
- %APPDATA%\neptune player\neptune-player.db-journal
- %APPDATA%\neptune player\preferences~rf119858.tmp
- %APPDATA%\neptune player\network persistent state~rf12a63d.tmp
Moves the following files
- from %APPDATA%\neptune player\code cache\js\index-dir\temp-index to %APPDATA%\neptune player\code cache\js\index-dir\the-real-index
- from %APPDATA%\neptune player\de39a105-374c-48a9-aae0-f4a45bb1bdce.tmp to %APPDATA%\neptune player\preferences
- from %APPDATA%\neptune player\local storage\leveldb\000001.dbtmp to %APPDATA%\neptune player\local storage\leveldb\current
- from %APPDATA%\neptune player\00ed1760-b2ed-40c6-ae22-241e55aac2c8.tmp to %APPDATA%\neptune player\network persistent state
- from %APPDATA%\neptune player\795fd7e5-256c-4f1a-a617-5d9312dc730e.tmp to %APPDATA%\neptune player\preferences
- from %APPDATA%\neptune player\preferences to %APPDATA%\neptune player\preferences~rf119858.tmp
- from %APPDATA%\neptune player\4bc6337f-b030-4d02-a95a-5cfb17e38dff.tmp to %APPDATA%\neptune player\transportsecurity
- from %APPDATA%\neptune player\network persistent state to %APPDATA%\neptune player\network persistent state~rf12a63d.tmp
Substitutes the following files
- %APPDATA%\neptune player\neptune-player.db-journal
- %APPDATA%\neptune player\preferences
Network activity
Connects to
- 'do#####d.teamviewer.com':443
- 're####ctor.gvt1.com':443
- 'r3######5hne6nsk.gvt1.com':443
- 'cd###.#loudflare.com':443
- 're######.player.neptunenow.com':443
- 'x.##2.us':80
- 'microsoft.com':80
- 'o3#####.ingest.sentry.io':443
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'do#####d.teamviewer.com':443
- 're####ctor.gvt1.com':443
- 'r3######5hne6nsk.gvt1.com':443
- 'cd###.#loudflare.com':443
- 're######.player.neptunenow.com':443
- 'o3#####.ingest.sentry.io':443
UDP
- DNS ASK do#####d.teamviewer.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK r3######5hne6nsk.gvt1.com
- DNS ASK ap#.####er.neptunenow.com
- DNS ASK so###.##ayer.neptunenow.com
- DNS ASK tr#######cured.neptunenow.com
- DNS ASK vo#####.neptunenow.com
- DNS ASK cd###.#loudflare.com
- DNS ASK re######.player.neptunenow.com
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK o3#####.ingest.sentry.io
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Neptune Player'
Creates and executes the following
- '%ProgramFiles%\neptune player\neptune player.exe'
- '%ProgramFiles%\neptune player\neptune player.exe' --no-rate-limit --no-upload-gzip --type=crash-handler "--crashes-directory=%TEMP%\Neptune Player Crashes" "--database=%TEMP%\Neptune Player Crashes" "--metrics-dir=%TEMP%\Neptune Player Crashes...
- '%ProgramFiles%\neptune player\neptune player.exe' --type=gpu-process --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-pre...
- '%ProgramFiles%\neptune player\neptune player.exe' --type=utility --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US ...
- '%ProgramFiles%\neptune player\neptune player.exe' --type=renderer --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US...
- '%ProgramFiles%\neptune player\neptune player.exe' --type=gpu-process --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable...
- '<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player"' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player" /t REG_SZ /d "\"%ProgramFiles%\Neptune Player\Neptune Player.exe\"" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "chcp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe csproduct get /value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player"
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\wmi path MS_SystemInformation get /value
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get Caption,FileSystem,FreeSpace,Size
- '<SYSTEM32>\wbem\wmic.exe' os get /value
- '<SYSTEM32>\wbem\wmic.exe' csproduct get /value
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe csproduct get /value"
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
- '<SYSTEM32>\chcp.com'
- '<SYSTEM32>\cmd.exe' /d /s /c "chcp"
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player" /t REG_SZ /d "\"%ProgramFiles%\Neptune Player\Neptune Player.exe\"" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"
- '<SYSTEM32>\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"
