donutloader | 9f7bf14ba4ebd047fe0382abd5d411575f137327faf6aa022f4fa3128291537a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonService.exe
Size 2.6MB
Sample260718-14f8ssd17l
SHA256 9f7bf14ba4ebd047fe0382abd5d411575f137327faf6aa022f4fa3128291537a
MD5 08f9483e5939760944a7b1e2a8a85008
SHA1 b45b5c246d208a0e2f3ac63ce4e0822274beaf84
SHA512 9343acfde0dd2f00e32c604d757957f6166e512af89029f89c279f3db486b8641c3573aa5762145fd2a7fe94492a8062e0dc0ac30c29b0d30314194073cd81a9
SSDEEP 384:O00RrUnRzlJzku8A90swgcAI/miS0Z+nYbfVrn3tgGh2a4YZ5BIa5E/oOAJfmUGv:jeraRz39d+3y
TLSH
T16BC51029DF7B29FF0026CC9BDBD28263F4549126699D9BA209D243EB0793D076493D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader umbral loader persistence stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5492-10-0x0000000004E10000-0x0000000004E52000-memory.dmp	family_donutloader

Detects Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/5492-11-0x0000000005060000-0x00000000050A0000-memory.dmp	family_umbral_obfuscated

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1484	MasonService.exe
5492	MasonService.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
12	discord.com
15	discord.com
20	discord.com
23	discord.com
26	discord.com
29	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MasonService.exe	MasonService.exe
File opened for modification	C:\Windows\SysWOW64\MasonService.exe	MasonService.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\rgTR28a3YFsfCKV.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\VclrIoY4cE7hu0b.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\T015m5yxrQ6oVRB.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\ZsJ6irznOIi5wiS.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\SevUeY656jT83s3.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\5ovh2CYRlxoBAf2.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\avNV3K9bRL80qFZ.ligma	MasonService.exe
File created	C:\Windows\SystemTemp\XUrccYQ483Otdvw.ligma	MasonService.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4112	sc.exe
4968	sc.exe
5664	sc.exe
2968	sc.exe
5408	sc.exe
5164	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonService.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5660	wmic.exe
5812	wmic.exe
2900	wmic.exe
3488	wmic.exe
4980	wmic.exe
6000	wmic.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wmic.exe	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting	MasonService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Disabled = "1"	MasonService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MasonService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	wmic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe\VBScriptSetScriptStateStarted = "240762281"	wmic.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3648	wmic.exe
3648	wmic.exe
3648	wmic.exe
3648	wmic.exe
5900	wmic.exe
5900	wmic.exe
5900	wmic.exe
5900	wmic.exe
3016	wmic.exe
3016	wmic.exe
3016	wmic.exe
3016	wmic.exe
5660	wmic.exe
5660	wmic.exe
5660	wmic.exe
5660	wmic.exe
4840	wmic.exe
4840	wmic.exe
4840	wmic.exe
4840	wmic.exe
2420	wmic.exe
2420	wmic.exe
2420	wmic.exe
2420	wmic.exe
5568	wmic.exe
5568	wmic.exe
5568	wmic.exe
5568	wmic.exe
5812	wmic.exe
5812	wmic.exe
5812	wmic.exe
5812	wmic.exe
1520	wmic.exe
1520	wmic.exe
1520	wmic.exe
1520	wmic.exe
4392	wmic.exe
4392	wmic.exe
4392	wmic.exe
4392	wmic.exe
5364	wmic.exe
5364	wmic.exe
5364	wmic.exe
5364	wmic.exe
2900	wmic.exe
2900	wmic.exe
2900	wmic.exe
2900	wmic.exe
1688	wmic.exe
1688	wmic.exe
1688	wmic.exe
1688	wmic.exe
5600	wmic.exe
5600	wmic.exe
5600	wmic.exe
5600	wmic.exe
4452	wmic.exe
4452	wmic.exe
4452	wmic.exe
4452	wmic.exe
3488	wmic.exe
3488	wmic.exe
3488	wmic.exe
3488	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	MasonService.exe
Token: SeDebugPrivilege	1484	MasonService.exe
Token: SeDebugPrivilege	5492	MasonService.exe
Token: SeDebugPrivilege	5492	MasonService.exe
Token: SeDebugPrivilege	5492	MasonService.exe
Token: SeAssignPrimaryTokenPrivilege	3648	wmic.exe
Token: SeIncreaseQuotaPrivilege	3648	wmic.exe
Token: SeSecurityPrivilege	3648	wmic.exe
Token: SeTakeOwnershipPrivilege	3648	wmic.exe
Token: SeLoadDriverPrivilege	3648	wmic.exe
Token: SeSystemtimePrivilege	3648	wmic.exe
Token: SeBackupPrivilege	3648	wmic.exe
Token: SeRestorePrivilege	3648	wmic.exe
Token: SeShutdownPrivilege	3648	wmic.exe
Token: SeSystemEnvironmentPrivilege	3648	wmic.exe
Token: SeUndockPrivilege	3648	wmic.exe
Token: SeManageVolumePrivilege	3648	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	3648	wmic.exe
Token: SeIncreaseQuotaPrivilege	3648	wmic.exe
Token: SeSecurityPrivilege	3648	wmic.exe
Token: SeTakeOwnershipPrivilege	3648	wmic.exe
Token: SeLoadDriverPrivilege	3648	wmic.exe
Token: SeSystemtimePrivilege	3648	wmic.exe
Token: SeBackupPrivilege	3648	wmic.exe
Token: SeRestorePrivilege	3648	wmic.exe
Token: SeShutdownPrivilege	3648	wmic.exe
Token: SeSystemEnvironmentPrivilege	3648	wmic.exe
Token: SeUndockPrivilege	3648	wmic.exe
Token: SeManageVolumePrivilege	3648	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	5900	wmic.exe
Token: SeIncreaseQuotaPrivilege	5900	wmic.exe
Token: SeSecurityPrivilege	5900	wmic.exe
Token: SeTakeOwnershipPrivilege	5900	wmic.exe
Token: SeLoadDriverPrivilege	5900	wmic.exe
Token: SeSystemtimePrivilege	5900	wmic.exe
Token: SeBackupPrivilege	5900	wmic.exe
Token: SeRestorePrivilege	5900	wmic.exe
Token: SeShutdownPrivilege	5900	wmic.exe
Token: SeSystemEnvironmentPrivilege	5900	wmic.exe
Token: SeUndockPrivilege	5900	wmic.exe
Token: SeManageVolumePrivilege	5900	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	5900	wmic.exe
Token: SeIncreaseQuotaPrivilege	5900	wmic.exe
Token: SeSecurityPrivilege	5900	wmic.exe
Token: SeTakeOwnershipPrivilege	5900	wmic.exe
Token: SeLoadDriverPrivilege	5900	wmic.exe
Token: SeSystemtimePrivilege	5900	wmic.exe
Token: SeBackupPrivilege	5900	wmic.exe
Token: SeRestorePrivilege	5900	wmic.exe
Token: SeShutdownPrivilege	5900	wmic.exe
Token: SeSystemEnvironmentPrivilege	5900	wmic.exe
Token: SeUndockPrivilege	5900	wmic.exe
Token: SeManageVolumePrivilege	5900	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	3016	wmic.exe
Token: SeIncreaseQuotaPrivilege	3016	wmic.exe
Token: SeSecurityPrivilege	3016	wmic.exe
Token: SeTakeOwnershipPrivilege	3016	wmic.exe
Token: SeLoadDriverPrivilege	3016	wmic.exe
Token: SeSystemtimePrivilege	3016	wmic.exe
Token: SeBackupPrivilege	3016	wmic.exe
Token: SeRestorePrivilege	3016	wmic.exe
Token: SeShutdownPrivilege	3016	wmic.exe
Token: SeSystemEnvironmentPrivilege	3016	wmic.exe
Token: SeUndockPrivilege	3016	wmic.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1484	2448	MasonService.exe	89
PID 1484 wrote to memory of 4112	1484	MasonService.exe	90
PID 1484 wrote to memory of 4968	1484	MasonService.exe	92
PID 1484 wrote to memory of 5664	1484	MasonService.exe	94
PID 1484 wrote to memory of 2968	1484	MasonService.exe	96
PID 1484 wrote to memory of 5408	1484	MasonService.exe	98
PID 1484 wrote to memory of 5164	1484	MasonService.exe	100
PID 5492 wrote to memory of 3648	5492	MasonService.exe	104
PID 5492 wrote to memory of 5900	5492	MasonService.exe	107
PID 5492 wrote to memory of 3016	5492	MasonService.exe	109
PID 5492 wrote to memory of 5660	5492	MasonService.exe	111
PID 5492 wrote to memory of 4840	5492	MasonService.exe	113
PID 5492 wrote to memory of 2420	5492	MasonService.exe	115
PID 5492 wrote to memory of 5568	5492	MasonService.exe	117
PID 5492 wrote to memory of 5812	5492	MasonService.exe	119
PID 5492 wrote to memory of 1520	5492	MasonService.exe	121
PID 5492 wrote to memory of 4392	5492	MasonService.exe	123
PID 5492 wrote to memory of 5364	5492	MasonService.exe	125
PID 5492 wrote to memory of 2900	5492	MasonService.exe	127
PID 5492 wrote to memory of 1688	5492	MasonService.exe	129
PID 5492 wrote to memory of 5600	5492	MasonService.exe	131
PID 5492 wrote to memory of 4452	5492	MasonService.exe	133
PID 5492 wrote to memory of 3488	5492	MasonService.exe	135
PID 5492 wrote to memory of 5624	5492	MasonService.exe	137
PID 5492 wrote to memory of 476	5492	MasonService.exe	139
PID 5492 wrote to memory of 3792	5492	MasonService.exe	141
PID 5492 wrote to memory of 4980	5492	MasonService.exe	143
PID 5492 wrote to memory of 6020	5492	MasonService.exe	145
PID 5492 wrote to memory of 5404	5492	MasonService.exe	147
PID 5492 wrote to memory of 2380	5492	MasonService.exe	149
PID 5492 wrote to memory of 6000	5492	MasonService.exe	151

C:\Users\Admin\AppData\Local\Temp\MasonService.exe
"C:\Users\Admin\AppData\Local\Temp\MasonService.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\MasonService.exe
  "C:\Windows\System32\MasonService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" stop MasonService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" delete MasonService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" create MasonService binPath= "C:\Windows\System32\MasonService.exe /service" type= own start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5664
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" description MasonService "Mason Stable Service (Single Instance)"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" failure MasonService reset= 3600 actions= restart/10000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" start MasonService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5164

C:\Windows\SysWOW64\MasonService.exe
C:\Windows\SysWOW64\MasonService.exe /service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:5660
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:5812
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5364
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5624
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  PID:476
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3792
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  PID:4980
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5404
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Detects videocard installed
  PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MasonService.exe

Path C:\Windows\SysWOW64\MasonService.exe
Size 2.6MB
SHA256 9f7bf14ba4ebd047fe0382abd5d411575f137327faf6aa022f4fa3128291537a
MD5 08f9483e5939760944a7b1e2a8a85008
SHA1 b45b5c246d208a0e2f3ac63ce4e0822274beaf84
SHA512 9343acfde0dd2f00e32c604d757957f6166e512af89029f89c279f3db486b8641c3573aa5762145fd2a7fe94492a8062e0dc0ac30c29b0d30314194073cd81a9
SSDEEP 384:O00RrUnRzlJzku8A90swgcAI/miS0Z+nYbfVrn3tgGh2a4YZ5BIa5E/oOAJfmUGv:jeraRz39d+3y
TLSH
T16BC51029DF7B29FF0026CC9BDBD28263F4549126699D9BA209D243EB0793D076493D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rgTR28a3YFsfCKV.ligma

Path C:\Windows\SystemTemp\rgTR28a3YFsfCKV.ligma
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

memory/1484-5-0x00000000751E0000-0x000000007599C000-memory.dmp

Download

memory/1484-9-0x00000000751E0000-0x000000007599C000-memory.dmp

Download

memory/1484-6-0x00000000751E0000-0x000000007599C000-memory.dmp

Download

memory/2448-4-0x00000000751E0000-0x000000007599C000-memory.dmp

Download

memory/2448-0-0x00000000751F2000-0x00000000751F3000-memory.dmp

Download

memory/2448-2-0x00000000751E0000-0x000000007599C000-memory.dmp

Download

memory/2448-1-0x0000000000FE0000-0x000000000127C000-memory.dmp

Download

memory/5492-8-0x00000000045B0000-0x00000000045D2000-memory.dmp

Download

memory/5492-10-0x0000000004E10000-0x0000000004E52000-memory.dmp

Download

memory/5492-12-0x0000000005140000-0x00000000051D2000-memory.dmp

Download

memory/5492-11-0x0000000005060000-0x00000000050A0000-memory.dmp

Download

memory/5492-13-0x0000000006DD0000-0x000000000738A000-memory.dmp

Download

memory/5492-14-0x00000000068D0000-0x00000000068DA000-memory.dmp

Download

memory/5492-15-0x0000000006900000-0x0000000006912000-memory.dmp

Download

memory/5492-17-0x0000000006B00000-0x0000000006B76000-memory.dmp

Download

memory/5492-21-0x0000000006DA0000-0x0000000006DBE000-memory.dmp

Download