donutloader | 5ba7cebac34a0b112719ee72d3d169dbf8a590a3a66da7dcf7b3e03b1acc567a

Analysis

max time kernel
63s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
powershell.exe
Size 1.8MB
Sample260907-1apyvagp7x
SHA256 5ba7cebac34a0b112719ee72d3d169dbf8a590a3a66da7dcf7b3e03b1acc567a
MD5 754276dcb19af36cdabd6181dd32af98
SHA1 538737716be18b63ed0c2e13589d906234bf5eb4
SHA512 492b277441d966f570e434becc8662c83381625a1eaea6f1cb47088d0b2022b0e42fc27f88776bb0ec7a7ee4ef38079764ec0249a18e1ff1c5a3e3546e66bd7d
SSDEEP 24576:N30MePl5+WSOxynqNTMg2k6YnyIJKxjQaThKDo2PzIqNcN20tG55ptxEhL:N6XMOynqpbhyYKNVKD4UO2uW5yL
TLSH
T105852311848A195AC9450FBDA8333C4C37F8A3F9D332329B6A1FD867FC947D685265AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader neptunerat loader persistence trojan

Malware Config

Extracted

Family

neptunerat

cryckLcracker-41656.portmap.host:41656

Attributes

filename
USB.exe
group
MasonGroup
key
OX8KRYKr8ZsL8rQJ
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3664-3-0x000000001BC60000-0x000000001BE02000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/3664-7-0x000000001C250000-0x000000001C3F0000-memory.dmp	family_neptunerat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4144 created 752	4144	MasonRootkit.exe	5

Executes dropped EXE 5 IoCs

pid	Process
880	MasonKit.exe
1632	Masonpowershell.exe
4144	MasonRootkit.exe
1148	Masonpowershell.exe
5244	Masonpowershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 4976	4144	MasonRootkit.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2960	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe
4144	MasonRootkit.exe
1148	Masonpowershell.exe
1148	Masonpowershell.exe
1148	Masonpowershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe
5244	Masonpowershell.exe
5244	Masonpowershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe
1632	Masonpowershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	1632	Masonpowershell.exe
Token: SeDebugPrivilege	1632	Masonpowershell.exe
Token: SeDebugPrivilege	4144	MasonRootkit.exe
Token: SeDebugPrivilege	4144	MasonRootkit.exe
Token: SeDebugPrivilege	1148	Masonpowershell.exe
Token: SeDebugPrivilege	1148	Masonpowershell.exe
Token: SeDebugPrivilege	5244	Masonpowershell.exe
Token: SeDebugPrivilege	5244	Masonpowershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 880	3664	powershell.exe	89
PID 3664 wrote to memory of 1632	3664	powershell.exe	90
PID 880 wrote to memory of 4144	880	MasonKit.exe	91
PID 880 wrote to memory of 4624	880	MasonKit.exe	92
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 4144 wrote to memory of 4976	4144	MasonRootkit.exe	94
PID 1632 wrote to memory of 4548	1632	Masonpowershell.exe	95
PID 4624 wrote to memory of 2960	4624	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:752
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0db5b211-68c2-47ba-ba92-31ed0f2dfeb7}
  2⤵
  PID:4976

C:\Users\Admin\AppData\Local\Temp\powershell.exe
"C:\Users\Admin\AppData\Local\Temp\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5C7E.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2960
- C:\Users\Admin\AppData\Roaming\Masonpowershell.exe
  "C:\Users\Admin\AppData\Roaming\Masonpowershell.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Masonpowershell" /tr "C:\Users\Admin\AppData\Roaming\Masonpowershell.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548

C:\Users\Admin\AppData\Roaming\Masonpowershell.exe
C:\Users\Admin\AppData\Roaming\Masonpowershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Users\Admin\AppData\Roaming\Masonpowershell.exe
"C:\Users\Admin\AppData\Roaming\Masonpowershell.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonKit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
Size 595KB
SHA256 7596f8d9c6fca490a5d657b994c0399ce5197e41102c66fe296408f5b37bf3f1
MD5 75c6f68abba95ddfd287f61b827e2711
SHA1 5dbd72d6e361b6af2e89b2aa49d3b64bd81d71a1
SHA512 103c3d754f26c059876a7c835b7bb69401d38a7b42cde7878a25cf5f127a77657b00d9d03d3eecbc08237c79d497785b69fd31560127dd37758dbe32d77b2e11
SSDEEP 12288:fWVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D:eVOQj+dWID+yG+zIzy7VxflRGa+Ci
TLSH
T1E7D423BC22F8F19DD54DC9393BF7025A4221F52F5810A36227A459CD2EF382D8D8DE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 592KB
SHA256 8de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447
MD5 ae78843b23f7a1c65f6b9a5a031f1950
SHA1 a12aad340d3eafb919d6cf38fad402f29b570ed0
SHA512 648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5
SSDEEP 12288:jK6oSHxX1Yrpx/bdEU5lRM+QAYw5p2r7H1xMolRUQErVD7ATfuXLF4:jzoyWr/b2+DM+QA5zM7VxjlRUQeVDUr8
TLSH
T175D423691391F0AFE1D9953F3667030689305628AE83EBFA13ED48A67FF74D7094C684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5C7E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5C7E.tmp.bat
Size 160B
SHA256 5db8d05fbdc4d425c1c8d594146cee99c52492bb3184da7877ebbdbcd0904879
MD5 6cf93fd330a83fec8adec239eb0d6c5d
SHA1 31147e810dcd185eb6f2fc30daaad92cb3680b59
SHA512 eb857afd091c86afbcf79c3e096e30a9398898dc5a5534f4c72b96f66aacdbf88642839b5027481fefcdacdb3ce476c5b36365f22f6c2599458d4497f74d7066
TLSH
T12DC08C4118CAFB0B2A8A242712B6C58EC1665C0A2E806B50939880092A804ACE5B5309
MD5 SHA1 SHA512 TLSH

Submit Download

Masonpowershell.exe

Path C:\Users\Admin\AppData\Roaming\Masonpowershell.exe
Size 1.8MB
SHA256 5ba7cebac34a0b112719ee72d3d169dbf8a590a3a66da7dcf7b3e03b1acc567a
MD5 754276dcb19af36cdabd6181dd32af98
SHA1 538737716be18b63ed0c2e13589d906234bf5eb4
SHA512 492b277441d966f570e434becc8662c83381625a1eaea6f1cb47088d0b2022b0e42fc27f88776bb0ec7a7ee4ef38079764ec0249a18e1ff1c5a3e3546e66bd7d
SSDEEP 24576:N30MePl5+WSOxynqNTMg2k6YnyIJKxjQaThKDo2PzIqNcN20tG55ptxEhL:N6XMOynqpbhyYKNVKD4UO2uW5yL
TLSH
T105852311848A195AC9450FBDA8333C4C37F8A3F9D332329B6A1FD867FC947D685265AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-42-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/880-28-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/880-20-0x0000000000F90000-0x000000000102C000-memory.dmp

Download

memory/3664-22-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-31-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-7-0x000000001C250000-0x000000001C3F0000-memory.dmp

Download

memory/3664-0-0x0000000000CC0000-0x0000000000E88000-memory.dmp

Download

memory/3664-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-3-0x000000001BC60000-0x000000001BE02000-memory.dmp

Download

memory/3664-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-23-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-1-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/3664-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4144-41-0x00007FF8DA4F0000-0x00007FF8DA5B7000-memory.dmp

Download

memory/4144-39-0x0000023D65750000-0x0000023D657EA000-memory.dmp

Download

memory/4144-40-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4976-43-0x0000000140000000-0x00000001401A1000-memory.dmp

Download