Analysis
- max time kernel
2s - max time network
8s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 02:44
Errors
General
- Target Squidward.exe
- Size 535KB
- Sample260817-c8lr3ssvdt
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Squidward.exe"C:\Users\Admin\AppData\Local\Temp\Squidward.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5990.tmp.bat""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F81⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-SLEEP.exe
MasonMBR.exe
MasonRootkit.exe
tmp5990.tmp.bat
memory/748-52-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/748-50-0x000002B77D400000-0x000002B77D425000-memory.dmp
memory/748-51-0x000002B77D430000-0x000002B77D45B000-memory.dmp
memory/964-56-0x0000013D3D870000-0x0000013D3D89B000-memory.dmp
memory/964-58-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/972-57-0x0000029334F60000-0x0000029334F8B000-memory.dmp
memory/972-60-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/984-103-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/984-101-0x000001A2E1410000-0x000001A2E143B000-memory.dmp
memory/1032-110-0x0000026788730000-0x000002678875B000-memory.dmp
memory/1032-112-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1108-122-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1108-119-0x0000028B0E130000-0x0000028B0E15B000-memory.dmp
memory/1164-67-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1164-66-0x00000225E4740000-0x00000225E476B000-memory.dmp
memory/1220-154-0x0000023E43670000-0x0000023E4369B000-memory.dmp
memory/1220-155-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1264-157-0x000002183E450000-0x000002183E47B000-memory.dmp
memory/1264-158-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1328-161-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1328-160-0x00000225A0940000-0x00000225A096B000-memory.dmp
memory/1356-164-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1356-163-0x00000259BEEE0000-0x00000259BEF0B000-memory.dmp
memory/1372-186-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1372-184-0x000002284AE40000-0x000002284AE6B000-memory.dmp
memory/1528-167-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1528-166-0x0000022E3D590000-0x0000022E3D5BB000-memory.dmp
memory/1540-81-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1540-79-0x0000020C9CF00000-0x0000020C9CF2B000-memory.dmp
memory/1588-169-0x0000026BFAB80000-0x0000026BFABAB000-memory.dmp
memory/1588-170-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1684-173-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1684-172-0x00000242A08B0000-0x00000242A08DB000-memory.dmp
memory/1696-175-0x000001B808EF0000-0x000001B808F1B000-memory.dmp
memory/1696-176-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1744-185-0x0000021C0BB40000-0x0000021C0BB6B000-memory.dmp
memory/1744-187-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1776-179-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/1776-178-0x000001DCBD5F0000-0x000001DCBD61B000-memory.dmp
memory/1948-190-0x000001DAACF60000-0x000001DAACF8B000-memory.dmp
memory/1948-191-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2012-182-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2012-181-0x000001DF76ED0000-0x000001DF76EFB000-memory.dmp
memory/2104-194-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2104-193-0x000002F531FD0000-0x000002F531FFB000-memory.dmp
memory/2208-196-0x0000011ADF380000-0x0000011ADF3AB000-memory.dmp
memory/2208-197-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2272-200-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2272-199-0x000001CBD1950000-0x000001CBD197B000-memory.dmp
memory/2356-202-0x0000017555F20000-0x0000017555F4B000-memory.dmp
memory/2356-203-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2468-205-0x00000207D3F40000-0x00000207D3F6B000-memory.dmp
memory/2468-206-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2528-208-0x0000010996930000-0x000001099695B000-memory.dmp
memory/2528-209-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2584-211-0x000001E799300000-0x000001E79932B000-memory.dmp
memory/2612-152-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2612-150-0x000001D11CF70000-0x000001D11CF9B000-memory.dmp
memory/2628-144-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/2628-143-0x0000000004DA0000-0x0000000004DCB000-memory.dmp
memory/2856-30-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/2856-21-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/2856-20-0x0000000000AE0000-0x0000000000AF6000-memory.dmp
memory/4576-33-0x00007FF8601C0000-0x00007FF860287000-memory.dmp
memory/4576-32-0x00007FF861AE0000-0x00007FF861D43000-memory.dmp
memory/4896-127-0x00000289EBF90000-0x00000289EBFBB000-memory.dmp
memory/4896-128-0x00007FF821C20000-0x00007FF821C30000-memory.dmp
memory/5128-40-0x0000000005670000-0x0000000005702000-memory.dmp
memory/5128-39-0x00000000008D0000-0x00000000008E6000-memory.dmp
memory/5732-0-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp
memory/5732-46-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/5732-4-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/5732-3-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/5732-2-0x0000000002FA0000-0x0000000002FE2000-memory.dmp
memory/5732-1-0x0000000000EF0000-0x0000000000F7C000-memory.dmp