donutloader | a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/02/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.6MB
Sample260210-q3qqqsfy2c
SHA256 a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8
MD5 3e00e682ce7fc9d845bbae841f1d2098
SHA1 a18defba6145e455166aeef8cb1f4080a3b81082
SHA512 a379f00e9740f40067fccb939d318ba40b18cbe12b3bc0944535c2f2b4c724461376d35b9e6ea99df1f11934ac72dc8c2310af5c093e7903e004931fea17bb7c
SSDEEP 24576:0FC/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:0FaTFylhjactTgl8F
TLSH
T12675492439FB501AB273EFA64BE479EADA6FB6333B076469105103864723E41DDC163E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

Turkialenzi-42249.portmap.host:42249

Mutex

HhNVZeuQ8poLfVMW

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/960-72-0x0000000002580000-0x000000000258E000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/960-70-0x0000000002490000-0x00000000024A0000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4764 created 636	4764	MasonRootkit.exe	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 9 IoCs

pid	Process
4060	MasonKit.exe
960	MasonLoader.exe
4764	MasonRootkit.exe
460	Loader.exe
1080	MasonLoader.exe
1776	MasonLoader.exe
4004	Loader.exe
1152	Loader.exe
3532	MasonLoader.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Loader	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonLoader	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 2196	4764	MasonRootkit.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4132	timeout.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={215766AD-561F-4FFA-9B6A-F416821B611F}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1770731390"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 10 Feb 2026 13:49:51 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2072	schtasks.exe
3564	schtasks.exe
4148	schtasks.exe
1480	schtasks.exe
3912	schtasks.exe
1272	schtasks.exe
2768	schtasks.exe
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4764	MasonRootkit.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3128	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	Loader.exe
Token: SeDebugPrivilege	4764	MasonRootkit.exe
Token: SeDebugPrivilege	4764	MasonRootkit.exe
Token: SeDebugPrivilege	2196	dllhost.exe
Token: SeDebugPrivilege	960	MasonLoader.exe
Token: SeDebugPrivilege	460	Loader.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	1080	MasonLoader.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	1776	MasonLoader.exe
Token: SeDebugPrivilege	4004	Loader.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	Conhost.exe
3604	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4148	3368	Loader.exe	80
PID 3368 wrote to memory of 4060	3368	Loader.exe	82
PID 3368 wrote to memory of 960	3368	Loader.exe	83
PID 4060 wrote to memory of 4764	4060	MasonKit.exe	84
PID 960 wrote to memory of 1272	960	MasonLoader.exe	85
PID 4060 wrote to memory of 2916	4060	MasonKit.exe	86
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 4764 wrote to memory of 2196	4764	MasonRootkit.exe	90
PID 2916 wrote to memory of 4132	2916	cmd.exe	91
PID 2196 wrote to memory of 636	2196	dllhost.exe	5
PID 2196 wrote to memory of 692	2196	dllhost.exe	7
PID 2196 wrote to memory of 904	2196	dllhost.exe	11
PID 2196 wrote to memory of 388	2196	dllhost.exe	13
PID 2196 wrote to memory of 776	2196	dllhost.exe	14
PID 2196 wrote to memory of 440	2196	dllhost.exe	15
PID 2196 wrote to memory of 1032	2196	dllhost.exe	16
PID 2196 wrote to memory of 1128	2196	dllhost.exe	17
PID 2196 wrote to memory of 1140	2196	dllhost.exe	18
PID 2196 wrote to memory of 1244	2196	dllhost.exe	20
PID 2196 wrote to memory of 1288	2196	dllhost.exe	21
PID 460 wrote to memory of 1480	460	Loader.exe	94
PID 2196 wrote to memory of 1296	2196	dllhost.exe	22
PID 2196 wrote to memory of 1360	2196	dllhost.exe	23
PID 2196 wrote to memory of 1396	2196	dllhost.exe	24
PID 2196 wrote to memory of 1516	2196	dllhost.exe	25
PID 2196 wrote to memory of 1524	2196	dllhost.exe	26
PID 2196 wrote to memory of 1696	2196	dllhost.exe	27
PID 2196 wrote to memory of 1788	2196	dllhost.exe	28
PID 2196 wrote to memory of 1808	2196	dllhost.exe	29
PID 2196 wrote to memory of 1872	2196	dllhost.exe	30
PID 2196 wrote to memory of 1904	2196	dllhost.exe	31
PID 1080 wrote to memory of 3912	1080	MasonLoader.exe	97
PID 2196 wrote to memory of 1968	2196	dllhost.exe	32
PID 2196 wrote to memory of 1976	2196	dllhost.exe	33
PID 2196 wrote to memory of 1660	2196	dllhost.exe	34
PID 2196 wrote to memory of 2028	2196	dllhost.exe	35
PID 2196 wrote to memory of 2052	2196	dllhost.exe	36
PID 2196 wrote to memory of 2156	2196	dllhost.exe	37
PID 2196 wrote to memory of 2236	2196	dllhost.exe	38
PID 2196 wrote to memory of 2248	2196	dllhost.exe	39
PID 2196 wrote to memory of 2408	2196	dllhost.exe	41
PID 2196 wrote to memory of 2564	2196	dllhost.exe	42
PID 2196 wrote to memory of 2576	2196	dllhost.exe	43
PID 2196 wrote to memory of 2656	2196	dllhost.exe	45
PID 2196 wrote to memory of 2668	2196	dllhost.exe	46
PID 2196 wrote to memory of 2684	2196	dllhost.exe	47
PID 2196 wrote to memory of 2700	2196	dllhost.exe	48
PID 2196 wrote to memory of 2716	2196	dllhost.exe	49
PID 2196 wrote to memory of 2744	2196	dllhost.exe	50
PID 2196 wrote to memory of 2560	2196	dllhost.exe	51
PID 2196 wrote to memory of 1100	2196	dllhost.exe	52
PID 2196 wrote to memory of 3128	2196	dllhost.exe	53
PID 2196 wrote to memory of 3256	2196	dllhost.exe	54
PID 2196 wrote to memory of 3304	2196	dllhost.exe	55
PID 2196 wrote to memory of 3592	2196	dllhost.exe	58
PID 2196 wrote to memory of 3660	2196	dllhost.exe	59
PID 2196 wrote to memory of 3744	2196	dllhost.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:776
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{74d86e8f-cd71-4c65-ae2b-a2f47cda4aad}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-eb9664c9-a620-424a-8d8a-756dea9a1493 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3a2e468a-2c83-4c2e-862f-7c570bc4e46f -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d336daad-8594-4f16-a1e9-cc788d24851e -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ba9f7824-6bc3-46ce-8869-a5a29f083cfd -LifetimeId:0e1cfa9e-1447-4054-8f3b-e7181aebec52 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1244
- C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1468
- C:\Users\Admin\AppData\Roaming\Loader.exe
  C:\Users\Admin\AppData\Roaming\Loader.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4556
- C:\Users\Admin\AppData\Roaming\Loader.exe
  C:\Users\Admin\AppData\Roaming\Loader.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2072
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3276
- C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1516
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2156

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3128
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFED2.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2172
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4132
- - C:\Users\Admin\AppData\Roaming\MasonLoader.exe
    "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2300

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2480

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4828

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4012

C:\Users\Admin\AppData\Roaming\Loader.exe
C:\Users\Admin\AppData\Roaming\Loader.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1480

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:392

C:\Users\Admin\AppData\Roaming\MasonLoader.exe
C:\Users\Admin\AppData\Roaming\MasonLoader.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log
Size 226B
SHA256 3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4
MD5 4ae344179932dc8e2c6fe2079f9753ef
SHA1 60eacc624412b1f34809780769e3b212f138ea9c
SHA512 fadfe2b83f1af8fdc50430325f69d6172d2c1e889ca3800b3b83e5535d5970c32e9a176b48563275a0630d56c96d9f88df148fd6b2d281f0fc58129e5f4dba19
TLSH
T190D023703350A0D544663FC2295C278DD1BF03156250FD107854254DD42411B7B311E3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonKit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
Size 595KB
SHA256 7596f8d9c6fca490a5d657b994c0399ce5197e41102c66fe296408f5b37bf3f1
MD5 75c6f68abba95ddfd287f61b827e2711
SHA1 5dbd72d6e361b6af2e89b2aa49d3b64bd81d71a1
SHA512 103c3d754f26c059876a7c835b7bb69401d38a7b42cde7878a25cf5f127a77657b00d9d03d3eecbc08237c79d497785b69fd31560127dd37758dbe32d77b2e11
SSDEEP 12288:fWVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D:eVOQj+dWID+yG+zIzy7VxflRGa+Ci
TLSH
T1E7D423BC22F8F19DD54DC9393BF7025A4221F52F5810A36227A459CD2EF382D8D8DE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 592KB
SHA256 8de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447
MD5 ae78843b23f7a1c65f6b9a5a031f1950
SHA1 a12aad340d3eafb919d6cf38fad402f29b570ed0
SHA512 648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5
SSDEEP 12288:jK6oSHxX1Yrpx/bdEU5lRM+QAYw5p2r7H1xMolRUQErVD7ATfuXLF4:jzoyWr/b2+DM+QA5zM7VxjlRUQeVDUr8
TLSH
T175D423691391F0AFE1D9953F3667030689305628AE83EBFA13ED48A67FF74D7094C684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpFED2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpFED2.tmp.bat
Size 160B
SHA256 b5385f207d95475bf244541996b19e6c2fa2e7a6c82631289700fc7576e44343
MD5 d2803d2ba212fc32ad7e663f40f3aed8
SHA1 4ee1a7da593c3f6d62418a4c09be5ba942feed27
SHA512 1ffd4fe904e9faa31b7ee634ccd387fbfa022063c7f16be37bbe5915da8b6ae6579d1f7079f18845bc09bd45a8f78311a82d0f4994165e7692d63274ed5c2f78
TLSH
T1CFC08C8214CAFB0A2A4B241725B6C08EC56A6C0A2E406B50939884082A804ACE8B430A
MD5 SHA1 SHA512 TLSH

Submit Download

MasonLoader.exe

Path C:\Users\Admin\AppData\Roaming\MasonLoader.exe
Size 1.6MB
SHA256 a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8
MD5 3e00e682ce7fc9d845bbae841f1d2098
SHA1 a18defba6145e455166aeef8cb1f4080a3b81082
SHA512 a379f00e9740f40067fccb939d318ba40b18cbe12b3bc0944535c2f2b4c724461376d35b9e6ea99df1f11934ac72dc8c2310af5c093e7903e004931fea17bb7c
SSDEEP 24576:0FC/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:0FaTFylhjactTgl8F
TLSH
T12675492439FB501AB273EFA64BE479EADA6FB6333B076469105103864723E41DDC163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-98-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/388-97-0x000001AD21740000-0x000001AD218FB000-memory.dmp

Download

memory/388-94-0x000001AD21740000-0x000001AD218FB000-memory.dmp

Download

memory/388-96-0x000001AD21740000-0x000001AD218FB000-memory.dmp

Download

memory/388-95-0x000001AD21740000-0x000001AD218FB000-memory.dmp

Download

memory/388-93-0x000001AD21740000-0x000001AD218FB000-memory.dmp

Download

memory/440-105-0x00000184DDE00000-0x00000184DDFBB000-memory.dmp

Download

memory/440-104-0x00000184DDE00000-0x00000184DDFBB000-memory.dmp

Download

memory/440-103-0x00000184DDE00000-0x00000184DDFBB000-memory.dmp

Download

memory/440-108-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/440-107-0x00000184DDE00000-0x00000184DDFBB000-memory.dmp

Download

memory/440-106-0x00000184DDE00000-0x00000184DDFBB000-memory.dmp

Download

memory/636-59-0x000002156A750000-0x000002156A90B000-memory.dmp

Download

memory/636-60-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/636-55-0x000002156A750000-0x000002156A90B000-memory.dmp

Download

memory/636-56-0x000002156A750000-0x000002156A90B000-memory.dmp

Download

memory/636-57-0x000002156A750000-0x000002156A90B000-memory.dmp

Download

memory/636-58-0x000002156A750000-0x000002156A90B000-memory.dmp

Download

memory/692-62-0x000001C4AC790000-0x000001C4AC8CE000-memory.dmp

Download

memory/692-66-0x000001C4AC8D0000-0x000001C4ACA8B000-memory.dmp

Download

memory/692-68-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/692-63-0x000001C4AC8D0000-0x000001C4ACA8B000-memory.dmp

Download

memory/692-65-0x000001C4AC8D0000-0x000001C4ACA8B000-memory.dmp

Download

memory/692-64-0x000001C4AC8D0000-0x000001C4ACA8B000-memory.dmp

Download

memory/692-67-0x000001C4AC8D0000-0x000001C4ACA8B000-memory.dmp

Download

memory/776-82-0x000001FEB99F0000-0x000001FEB9BAB000-memory.dmp

Download

memory/776-84-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/776-81-0x000001FEB99F0000-0x000001FEB9BAB000-memory.dmp

Download

memory/776-80-0x000001FEB99F0000-0x000001FEB9BAB000-memory.dmp

Download

memory/776-79-0x000001FEB99F0000-0x000001FEB9BAB000-memory.dmp

Download

memory/776-83-0x000001FEB99F0000-0x000001FEB9BAB000-memory.dmp

Download

memory/904-88-0x000002AEF8EE0000-0x000002AEF909B000-memory.dmp

Download

memory/904-87-0x000002AEF8EE0000-0x000002AEF909B000-memory.dmp

Download

memory/904-86-0x000002AEF8EE0000-0x000002AEF909B000-memory.dmp

Download

memory/904-91-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/904-89-0x000002AEF8EE0000-0x000002AEF909B000-memory.dmp

Download

memory/904-90-0x000002AEF8EE0000-0x000002AEF909B000-memory.dmp

Download

memory/960-72-0x0000000002580000-0x000000000258E000-memory.dmp

Download

memory/960-70-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/1032-111-0x000001BFD0A80000-0x000001BFD0C3B000-memory.dmp

Download

memory/1032-115-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/1032-114-0x000001BFD0A80000-0x000001BFD0C3B000-memory.dmp

Download

memory/1032-110-0x000001BFD0A80000-0x000001BFD0C3B000-memory.dmp

Download

memory/1032-112-0x000001BFD0A80000-0x000001BFD0C3B000-memory.dmp

Download

memory/1032-113-0x000001BFD0A80000-0x000001BFD0C3B000-memory.dmp

Download

memory/1128-120-0x000002363CC80000-0x000002363CE3B000-memory.dmp

Download

memory/1128-121-0x000002363CC80000-0x000002363CE3B000-memory.dmp

Download

memory/1128-122-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/1128-119-0x000002363CC80000-0x000002363CE3B000-memory.dmp

Download

memory/1128-118-0x000002363CC80000-0x000002363CE3B000-memory.dmp

Download

memory/1128-117-0x000002363CC80000-0x000002363CE3B000-memory.dmp

Download

memory/1140-130-0x000002B7D2340000-0x000002B7D24FB000-memory.dmp

Download

memory/1140-131-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/1140-129-0x000002B7D2340000-0x000002B7D24FB000-memory.dmp

Download

memory/1140-128-0x000002B7D2340000-0x000002B7D24FB000-memory.dmp

Download

memory/1140-127-0x000002B7D2340000-0x000002B7D24FB000-memory.dmp

Download

memory/1140-126-0x000002B7D2340000-0x000002B7D24FB000-memory.dmp

Download

memory/1152-728-0x0000000000E40000-0x0000000000FE4000-memory.dmp

Download

memory/2196-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2196-45-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2196-48-0x00007FFA96680000-0x00007FFA96889000-memory.dmp

Download

memory/2196-49-0x00007FFA94730000-0x00007FFA947ED000-memory.dmp

Download

memory/2196-47-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3368-0-0x00000000008F0000-0x0000000000A94000-memory.dmp

Download

memory/4004-674-0x0000000000E20000-0x0000000000FC4000-memory.dmp

Download

memory/4060-44-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

Download

memory/4060-26-0x00000000004E0000-0x000000000057C000-memory.dmp

Download

memory/4764-42-0x00007FFA94730000-0x00007FFA947ED000-memory.dmp

Download

memory/4764-41-0x00007FFA96680000-0x00007FFA96889000-memory.dmp

Download

memory/4764-38-0x000001A61E9F0000-0x000001A61EA8A000-memory.dmp

Download