donutloader | ecbeaa3ddac02f621f8d2d8a70b816bb8dade6388a54532daf96da5bf16db31e

Analysis

max time kernel
898s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 84KB
Sample260731-enfrfacd74
SHA256 ecbeaa3ddac02f621f8d2d8a70b816bb8dade6388a54532daf96da5bf16db31e
MD5 e04a4a00b95a097c4ed64a86ee837254
SHA1 c071aa08847b762e24f2bcfafe7570c3aec3dd29
SHA512 d80002fc4ab1b41b5b40f34046d4bbe557624ddc86831c7590f765db6c4ad5c5cd7b998ea427cbdd2c562b7d9ab0a231d114f151f11d84533d0e805a15150a4c
SSDEEP 1536:CqG1FWW1+01pN0WYuvIMIRWXADK1L+yM0TQG3KD69EsEq36B5AJgzt8n2:Cqmx1+gj0WYuvJX1JpMs6DGEq3ArV
TLSH
T18E83E13BD20DB806E2D92739EDA9493C4497E3CB41E93289896B1B42D0D5FEFDE241D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader neptunerat loader persistence trojan

Malware Config

Extracted

Family

neptunerat

12.tcp.vip.cpolar.cn:1017

Attributes

filename
MasonUSB.exe
group
MasonGroup
key
3Y5b0X0lUQGFW7ig
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral3/memory/5592-1-0x00000000026A0000-0x00000000026B4000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 5 IoCs

resource	yara_rule
behavioral3/memory/5592-3-0x00000000026F0000-0x0000000002702000-memory.dmp	family_neptunerat
behavioral3/memory/4576-30-0x0000000002480000-0x0000000002492000-memory.dmp	family_neptunerat
behavioral3/memory/5244-43-0x0000000002EB0000-0x0000000002EC2000-memory.dmp	family_neptunerat
behavioral3/memory/3164-48-0x0000000002CB0000-0x0000000002CC2000-memory.dmp	family_neptunerat
behavioral3/memory/1484-69-0x00000000024E0000-0x00000000024F2000-memory.dmp	family_neptunerat

Executes dropped EXE 16 IoCs

pid	Process
5556	MasonClient.exe
5944	MasonClient.exe
4916	MasonClient.exe
4068	MasonClient.exe
4576	MasonClient.exe
2924	MasonClient.exe
2576	MasonClient.exe
5244	MasonClient.exe
3164	MasonClient.exe
4680	MasonClient.exe
244	MasonClient.exe
4148	MasonClient.exe
1776	MasonClient.exe
1484	MasonClient.exe
5748	MasonClient.exe
3004	MasonClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1212	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5592	MasonClient.exe
Token: SeDebugPrivilege	5556	MasonClient.exe
Token: SeDebugPrivilege	5944	MasonClient.exe
Token: SeDebugPrivilege	4916	MasonClient.exe
Token: SeDebugPrivilege	4068	MasonClient.exe
Token: SeDebugPrivilege	4576	MasonClient.exe
Token: SeDebugPrivilege	2924	MasonClient.exe
Token: SeDebugPrivilege	2576	MasonClient.exe
Token: SeDebugPrivilege	5244	MasonClient.exe
Token: SeDebugPrivilege	3164	MasonClient.exe
Token: SeDebugPrivilege	4680	MasonClient.exe
Token: SeDebugPrivilege	244	MasonClient.exe
Token: SeDebugPrivilege	4148	MasonClient.exe
Token: SeDebugPrivilege	1776	MasonClient.exe
Token: SeDebugPrivilege	1484	MasonClient.exe
Token: SeDebugPrivilege	5748	MasonClient.exe
Token: SeDebugPrivilege	3004	MasonClient.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1212	5592	MasonClient.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1212

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 84KB
SHA256 ecbeaa3ddac02f621f8d2d8a70b816bb8dade6388a54532daf96da5bf16db31e
MD5 e04a4a00b95a097c4ed64a86ee837254
SHA1 c071aa08847b762e24f2bcfafe7570c3aec3dd29
SHA512 d80002fc4ab1b41b5b40f34046d4bbe557624ddc86831c7590f765db6c4ad5c5cd7b998ea427cbdd2c562b7d9ab0a231d114f151f11d84533d0e805a15150a4c
SSDEEP 1536:CqG1FWW1+01pN0WYuvIMIRWXADK1L+yM0TQG3KD69EsEq36B5AJgzt8n2:Cqmx1+gj0WYuvJX1JpMs6DGEq3ArV
TLSH
T18E83E13BD20DB806E2D92739EDA9493C4497E3CB41E93289896B1B42D0D5FEFDE241D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-69-0x00000000024E0000-0x00000000024F2000-memory.dmp

Download

memory/3164-48-0x0000000002CB0000-0x0000000002CC2000-memory.dmp

Download

memory/4576-30-0x0000000002480000-0x0000000002492000-memory.dmp

Download

memory/5244-43-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

Download

memory/5592-1-0x00000000026A0000-0x00000000026B4000-memory.dmp

Download

memory/5592-0-0x00000000004C0000-0x00000000004DC000-memory.dmp

Download

memory/5592-3-0x00000000026F0000-0x0000000002702000-memory.dmp

Download

memory/5592-4-0x00007FFE8D1A0000-0x00007FFE8D2C0000-memory.dmp

Download

memory/5592-6-0x00007FFE8D1A0000-0x00007FFE8D2C0000-memory.dmp

Download

memory/5592-13-0x00007FFE8D1A0000-0x00007FFE8D2C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads