neptunerat | a5a62e8c26dc78c3841c7f8b1fc278e1dd0886223ac1a8cf9865443b01f45e00

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/08/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 48KB
Sample260824-j5eypace67
SHA256 a5a62e8c26dc78c3841c7f8b1fc278e1dd0886223ac1a8cf9865443b01f45e00
MD5 194f37f54e89fba0ae113caef3a39486
SHA1 36548dbf5a1bb07ef20bc585fa5cd0b9fd4c8b0c
SHA512 bf85bb6909c968fce22304ccd879b36361a43396cd37f9d58bd1b937cadef905c7a11e3264787895129dd3e4da4acf276c9349be337e7d501054fed6e6b10d23
SSDEEP 768:nrZHcRaAmdhijCmgTNttz+bwy7+Qsh5ANI2ushLOOOYw:nr+Ralh9mgTNrz+bwU+Q0k1OPYw
TLSH
T12F23D68DBBE40128D5BF5BF16E73A20987B079975516C21FBCD406CB2B267884690EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

24.tcp.cpolar.top:13589

Attributes

filename
USB.exe
group
MasonGroup
key
q4fYbPO4E8UvmPDd
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral3/memory/4836-0-0x0000000000D80000-0x0000000000D92000-memory.dmp	family_neptunerat
behavioral3/files/0x001d000000025f89-3.dat	family_neptunerat

Executes dropped EXE 4 IoCs

pid	Process
4052	MasonClient.exe
2008	MasonClient.exe
3412	MasonClient.exe
1996	MasonClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	MasonClient.exe
Token: SeDebugPrivilege	4052	MasonClient.exe
Token: SeDebugPrivilege	2008	MasonClient.exe
Token: SeDebugPrivilege	3412	MasonClient.exe
Token: SeDebugPrivilege	1996	MasonClient.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1640	4836	MasonClient.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1640

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 48KB
SHA256 a5a62e8c26dc78c3841c7f8b1fc278e1dd0886223ac1a8cf9865443b01f45e00
MD5 194f37f54e89fba0ae113caef3a39486
SHA1 36548dbf5a1bb07ef20bc585fa5cd0b9fd4c8b0c
SHA512 bf85bb6909c968fce22304ccd879b36361a43396cd37f9d58bd1b937cadef905c7a11e3264787895129dd3e4da4acf276c9349be337e7d501054fed6e6b10d23
SSDEEP 768:nrZHcRaAmdhijCmgTNttz+bwy7+Qsh5ANI2ushLOOOYw:nr+Ralh9mgTNrz+bwU+Q0k1OPYw
TLSH
T12F23D68DBBE40128D5BF5BF16E73A20987B079975516C21FBCD406CB2B267884690EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4836-0-0x0000000000D80000-0x0000000000D92000-memory.dmp

Download

memory/4836-2-0x0000000003030000-0x0000000003040000-memory.dmp

Download

memory/4836-8-0x0000000003030000-0x0000000003040000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads