5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 586KB
Sample260628-exb5lsfs2t
SHA256 5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9
MD5 4cf5f4b8573d0d55606b1bae6ee1fc64
SHA1 57a704edde9bd54a25f17533538472c2f72226ad
SHA512 d1edfb309db52d7b20ee4b10f0a37156e634ac7b4c72686557506512fcc90229ddd19958d47be5a6af6cf68872f5b4b41159d5e6d063bf579e952c61721cbcc7
SSDEEP 6144:lk18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4e3+4CTSy+7USz4MKI:+/Mv1jakVcpP/oBIbr3CTRIP
TLSH
T1ACD41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3824	EventCollectorService.exe
5028	EventCollectorService.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
444	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3824	1680	MasonClient.exe	81
PID 3824 wrote to memory of 5028	3824	EventCollectorService.exe	82
PID 3824 wrote to memory of 4508	3824	EventCollectorService.exe	83
PID 4508 wrote to memory of 2312	4508	cmd.exe	85
PID 3824 wrote to memory of 444	3824	EventCollectorService.exe	86
PID 444 wrote to memory of 2980	444	cmd.exe	88
PID 444 wrote to memory of 4532	444	cmd.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe" --r
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe
    "C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe" --wd 3824
    3⤵
    - Executes dropped EXE
    PID:5028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && Á¼¤F-{?„íPºTqP–À¼§3rù¬Ôºwí3rR/ †eo-[&ÝÚa ˆºT´@Wc<ê˜ªðy¡h>%‰¼’ŸÖœo¥d,Ž¨v'Z-U`ìcýL‹ÒÒ#éŸåÝÉF\ºÍÜÓŸÐà‡ ÜM)Õqç:QÚÓ4Œ°o¬GÍ&FÓÿ’JXâñ~›ß[‹¬šTÓœFó–j¼ÈŸ‘ÎR¦¶þ~n‹HÀO#ÃMC¥•,Fª¶iòÇ65H~¤tj°w7‰ú±U=óVç¶fú˜¯-Ô©þ^#P…)ïÑþÞ=i«2oþ±¥.žš}ëæl-U”ùÿrTöj‚«$,ÚSÛ¿ÚXfH °ŽÒNT¦ÿ^å`nòD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2312
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe"
      4⤵
      Views/modifies file attributes
      PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EventCollectorService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\EventCollectorService.exe
Size 586KB
SHA256 5e63ded29f2bb7d3bff50a9437868280ab1c1e85eed596a63aad0b35512a77c9
MD5 4cf5f4b8573d0d55606b1bae6ee1fc64
SHA1 57a704edde9bd54a25f17533538472c2f72226ad
SHA512 d1edfb309db52d7b20ee4b10f0a37156e634ac7b4c72686557506512fcc90229ddd19958d47be5a6af6cf68872f5b4b41159d5e6d063bf579e952c61721cbcc7
SSDEEP 6144:lk18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4e3+4CTSy+7USz4MKI:+/Mv1jakVcpP/oBIbr3CTRIP
TLSH
T1ACD41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-6-0x00007FF6D4740000-0x00007FF6D47EE000-memory.dmp

Download

memory/3824-7-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/3824-13-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/3824-17-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/3824-21-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/3824-25-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/3824-29-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

memory/5028-8-0x00007FF7CD570000-0x00007FF7CD61E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads