Extracted

• • Target
    MasonClient.exe
  • Size 84KB
  • SHA256 13ed4e1ebc340b18b3f69481b33c6c0f913a365181e3a320fdc3e5474bb276a4
  • MD5 d62fb031104faee75b58c6679787d1c3
  • SHA1 068fc7f33c95b283936d94c56ea62e21ca51b4af
  • SHA512 278b1dede969d98bafde5c9d8d93e6d780f0d2f30346c8a9ce835a83463fba96245bb559da337b535c0ccd9a99f93d08f509fe2f6d6a304bf10e81f032082e1f
  • SSDEEP 1536:3CEt5IvR2ZEN4kJ9rsUi89ijJdS/duMKOSxi1O6N7TmhOHsZCjpl+8gl77SCndf:33wsZENtHrFoji/dOfik6NfcZ4pxs77x
  • TLSH
    T10283F203BBD8CF62D8B9C5306D7E93A40090E3D8CEB59CE559681AE346D48C6CD7E6C2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoverydonutloaderneptuneratloaderpersistencetrojanexecution

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3