donutloader | da23b9aa136983e637c907eb89903b39ebd517e0dec2c04d7e418fa85945e7c4

General

Target
MasonMySql.exe
Size 85KB
Sample260505-vaaahafx4l
SHA256 da23b9aa136983e637c907eb89903b39ebd517e0dec2c04d7e418fa85945e7c4
MD5 9612e6ec00375610c4cc0725dc4ab790
SHA1 029cb9f7fc094722e7cb7a38e270093f8523631b
SHA512 b85bd4153931cd101c40a0e17841761e5ded389541d5c493d7259801771c90538bc3781ec71fbfdbacb43a4eeb3af722dba3822b1d37fbb05b0b462e98844634
SSDEEP 1536:TbfojIpD4r45qVhKz0Ig1cQ0u3nHyeG1jiEyqHLQeVRiOIwrXNqq:XiI+r4E80F50u3nHyeMcIoOIwIq
TLSH
T1A983F2A9B2D4A92EE1733B73CD7529F326B89ADD19A442F955CE73544318780CFE0610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  MasonMySql.exe
- Size 85KB
- SHA256 da23b9aa136983e637c907eb89903b39ebd517e0dec2c04d7e418fa85945e7c4
- MD5 9612e6ec00375610c4cc0725dc4ab790
- SHA1 029cb9f7fc094722e7cb7a38e270093f8523631b
- SHA512 b85bd4153931cd101c40a0e17841761e5ded389541d5c493d7259801771c90538bc3781ec71fbfdbacb43a4eeb3af722dba3822b1d37fbb05b0b462e98844634
- SSDEEP 1536:TbfojIpD4r45qVhKz0Ig1cQ0u3nHyeG1jiEyqHLQeVRiOIwrXNqq:XiI+r4E80F50u3nHyeMcIoOIwIq
- TLSH
  T1A983F2A9B2D4A92EE1733B73CD7529F326B89ADD19A442F955CE73544318780CFE0610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion execution donutloader neptunerat loader persistence trojan
- Detects DonutLoader
  loader
- Detects NeptuneRAT stealer
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1