5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9

Analysis

user interaction
yes
max time kernel
92s
max time network
95s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/06/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 586KB
Sample260628-exb5lsfs2t
SHA256 5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9
MD5 4cf5f4b8573d0d55606b1bae6ee1fc64
SHA1 57a704edde9bd54a25f17533538472c2f72226ad
SHA512 d1edfb309db52d7b20ee4b10f0a37156e634ac7b4c72686557506512fcc90229ddd19958d47be5a6af6cf68872f5b4b41159d5e6d063bf579e952c61721cbcc7
SSDEEP 6144:lk18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4e3+4CTSy+7USz4MKI:+/Mv1jakVcpP/oBIbr3CTRIP
TLSH
T1ACD41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1016	NetProfileRuntime.exe
1520	NetProfileRuntime.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4560	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1016	NetProfileRuntime.exe
1520	NetProfileRuntime.exe
4288	attrib.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1016	560	MasonClient.exe	83
PID 1016 wrote to memory of 1520	1016	NetProfileRuntime.exe	84
PID 1016 wrote to memory of 2856	1016	NetProfileRuntime.exe	85
PID 2856 wrote to memory of 4428	2856	cmd.exe	87
PID 1016 wrote to memory of 4560	1016	NetProfileRuntime.exe	88
PID 4560 wrote to memory of 3196	4560	cmd.exe	90
PID 4560 wrote to memory of 4288	4560	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4288	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe" --r
  2⤵
  - Executes dropped EXE
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe
    "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe" --wd 1016
    3⤵
    - Executes dropped EXE
    - System Time Discovery
    PID:1520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && Á¼¤F-{?„íPºTqP–À¼§3rù¬Ôºwí3rR/ †eo-[&ÝÚa ˆºT´@Wc<ê˜ªðy¡h>%‰¼’ŸÖœo¥d,Ž¨v'Z-U`ìcýL‹ÒÒ#éŸåÝÉF\ºÍÜÓŸÐà‡ ÜM)Õqç:QÚÓ4Œ°o¬GÍ&FÓÿ’JXâñ~›ß[‹¬šTÓœFó–j¼ÈŸ‘ÎR¦¶þ~n‹HÀO#ÃMC¥•,Fª¶iòÇ65H~¤tj°w7‰ú±U=óVç¶fú˜¯-Ô©þ^#P…)ïÑþÞ=i«2oþ±¥.žš}ëæl-U”ùÿrTöj‚«$,ÚSÛ¿ÚXfH °ŽÒNT¦ÿ^å`nòD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3196
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe"
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetProfileRuntime.exe

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\NetProfileRuntime.exe
Size 586KB
SHA256 5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9
MD5 4cf5f4b8573d0d55606b1bae6ee1fc64
SHA1 57a704edde9bd54a25f17533538472c2f72226ad
SHA512 d1edfb309db52d7b20ee4b10f0a37156e634ac7b4c72686557506512fcc90229ddd19958d47be5a6af6cf68872f5b4b41159d5e6d063bf579e952c61721cbcc7
SSDEEP 6144:lk18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4e3+4CTSy+7USz4MKI:+/Mv1jakVcpP/oBIbr3CTRIP
TLSH
T1ACD41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-2-0x00007FF795FC0000-0x00007FF79606E000-memory.dmp

Download

memory/1016-3-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

memory/1016-5-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

memory/1016-7-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

memory/1016-13-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

memory/1016-19-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

memory/1520-4-0x00007FF61C970000-0x00007FF61CA1E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads