Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 07:14
General
- Target 2026-08-12_aa90c8566901be87fa9b1a595e99c679_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
- Size 31.5MB
- Sample260812-h2xtnack2z
- SHA256 ef248d0a27e4d7eb9c22e96f103fc24b24d3c56b7598d5e43def6ae3cbe8e480
Malware Config
Extracted
-
neptunerat
-
6.tcp.cpolar.cn:13498
-
filename
USB.exe
-
group
MasonGroup
-
key
goqdlGdjwqoRUqml
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 16 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_aa90c8566901be87fa9b1a595e99c679_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_aa90c8566901be87fa9b1a595e99c679_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\WindowsSecurity.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\WindowsSecurity.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"C:\Users\Admin\AppData\Local\Temp\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005" /tr "C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\Windows.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\Windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\MasonDrop\AutoClicker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exeC:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"C:\Users\Admin\AppData\Roaming\fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
AutoClicker.exe
Bypassed.exe
Windows.exe
WindowsSecurity.exe
_imaging.cp311-win_amd64.pyd
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
init.tcl
package.tcl
tclIndex
tm.tcl
pkgIndex.tcl
tk.tcl
_tkinter.pyd
base_library.zip
blue.json
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
fc0fa74b-c4ab-46eb-b8ff-3acd0bfa9005.exe
memory/576-41-0x0000000000B10000-0x0000000000B24000-memory.dmp
memory/1256-44-0x00007FF6451A0000-0x00007FF6451AD000-memory.dmp
memory/1680-25-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/1680-46-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/1680-23-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/1680-22-0x0000000000210000-0x000000000023A000-memory.dmp
memory/3340-1089-0x00000002796F0000-0x000000027974A000-memory.dmp
memory/3340-1100-0x00007FF631060000-0x00007FF631079000-memory.dmp
memory/3340-1101-0x00007FF631060000-0x00007FF631079000-memory.dmp
memory/5000-1045-0x00000258B2D00000-0x00000258B2D1E000-memory.dmp
memory/5000-1069-0x00000258B2DE0000-0x00000258B2DEA000-memory.dmp
memory/5000-1049-0x00000258B2D20000-0x00000258B2DD2000-memory.dmp
memory/5000-803-0x00000258B2C70000-0x00000258B2C92000-memory.dmp
memory/5600-141-0x00007FF7C77B0000-0x00007FF7C77BE000-memory.dmp