Analysis
- user interaction
yes - max time kernel
408s - max time network
410s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/08/2026, 19:55
Errors
Reason
Machine shutdown
General
- Target MasonClient.exe
- Size 48KB
- Sample260820-ynfafsvala
- SHA256 fd63b76cd6af8482f19ee63275e3488c1b41f5edb56a7d22fc99b1e9e8ac5549
Score
10/10
Malware Config
Extracted
Family
-
neptunerat
C2
-
john12dqr23-37470.portmap.host:37470
Attributes
-
filename
USB.exe
-
group
MasonGroup
-
key
jfsOTWjKXbd66nfI
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a24055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2252-0-0x00007FFFABD1F000-0x00007FFFABD20000-memory.dmp
memory/2252-1-0x0000000000640000-0x0000000000652000-memory.dmp
memory/2252-2-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-3-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-4-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-5-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-7-0x0000000000D60000-0x0000000000D6E000-memory.dmp
memory/2252-8-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp