General
- Target MasonClient.exe
- Size 50KB
- Sample260818-t2fqxsxtes
- SHA256 49d32b89daf74d94ef7183a3011a987e7cefc121a0c7778d7d1905ad55f73270
Score
10/10
Malware Config
Targets
-
- Target MasonClient.exe
- Size 50KB
- SHA256 49d32b89daf74d94ef7183a3011a987e7cefc121a0c7778d7d1905ad55f73270
Score10/10-
Detects NeptuneRAT stealer
-
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Port Monitors
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Port Monitors
1Scheduled Task/Job
1Scheduled Task
1