Analysis
- max time kernel
34s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 14:07
Errors
General
- Target MasonClient.exe
- Size 49KB
- Sample260828-rfgd8adb74
- SHA256 7e2ffef9f04c4ac9c712661c93ddab73eada10fbcce8eb464293b3b91cea53d2
Malware Config
Extracted
-
neptunerat
-
hos5nckrhd.localto.net:4392
-
filename
USB.exe
-
group
MasonGroup
-
key
UKWpVpy37O9HsgUK
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Executes dropped EXE 5 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE35.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE35.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MatrixMBR.exe"C:\Windows\System32\MatrixMBR.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\GDI.exe"C:\Users\Admin\AppData\Local\Temp\GDI.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000005041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GDI.exe
MBR.exe
MBR2.exe
TROLL2.exe
TROLL5.exe
tmpBE35.tmp.exe
MatrixMBR.exe
memory/904-77-0x0000000000390000-0x00000000003D6000-memory.dmp
memory/2688-94-0x0000000000C60000-0x0000000000C68000-memory.dmp
memory/2708-49-0x0000000000F80000-0x0000000000FBA000-memory.dmp
memory/2896-10-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-11-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-12-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-13-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-14-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-15-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-16-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-17-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-1-0x00000000000C0000-0x00000000000D2000-memory.dmp
memory/2896-8-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-0-0x00007FFA936DF000-0x00007FFA936E0000-memory.dmp
memory/2896-2-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-3-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-4-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-5-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-6-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-7-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/2896-9-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-26-0x0000000000F10000-0x0000000000FFC000-memory.dmp
memory/3776-30-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-34-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-63-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-62-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-27-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-28-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-29-0x000000001BD60000-0x000000001BE44000-memory.dmp
memory/3776-35-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/3776-31-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp
memory/4916-67-0x00000000059B0000-0x00000000059BA000-memory.dmp
memory/4916-66-0x0000000005910000-0x00000000059A2000-memory.dmp
memory/4916-65-0x0000000005E30000-0x00000000063EA000-memory.dmp
memory/4916-64-0x0000000000E70000-0x0000000000F28000-memory.dmp
memory/6132-78-0x0000000000400000-0x000000000041D000-memory.dmp