Analysis
- user interaction
yes - max time kernel
34s - max time network
38s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 16:23
General
- Target DeadClient.exe
- Size 48KB
- Sample260721-tv38mscd38
- SHA256 3fa7bb9d15d664796f73891864cc59f5eeb0e7cb76976a954b9d7fd2450cddf6
Score
10/10
Malware Config
Extracted
Family
-
neptunerat
C2
-
12.tcp.cpolar.top:1193
Attributes
-
filename
USB.exe
-
group
MasonGroup
-
key
9Lpx8uaJcSj2i6hW
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DeadClient.exe"C:\Users\Admin\AppData\Local\Temp\DeadClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3956-0-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp
memory/3956-1-0x0000000000750000-0x0000000000762000-memory.dmp
memory/3956-2-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/3956-3-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/3956-4-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/3956-5-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/3956-6-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp