Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/09/2026, 22:00
General
- Target 2026-09-09_ed2ca96416b7eacffc09918a8c0a39fb_cobalt-strike_glassworm_njrat_satacom_vidar.exe
- Size 59.8MB
- Sample260910-1wnb5swgrf
- SHA256 6bcc47732f32b23d3c7483d83ad54386d628d9775c3843326b51005f4c0658e2
Malware Config
Extracted
-
neptunerat
-
filename
USB.exe
-
group
MasonGroup
-
key
LrzpZhWezNA1t3QS
-
localhost
127.0.0.1:1417
-
rat_name
MoustasheRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_ed2ca96416b7eacffc09918a8c0a39fb_cobalt-strike_glassworm_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_ed2ca96416b7eacffc09918a8c0a39fb_cobalt-strike_glassworm_njrat_satacom_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FP_ad764c8e\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\FP_ad764c8e\MasonClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonClient.exe
memory/1272-27-0x0000015FF67D0000-0x0000015FF67DD000-memory.dmp
memory/1272-33-0x0000015FF6AE0000-0x0000015FF6B01000-memory.dmp
memory/1272-18-0x0000015FF6860000-0x0000015FF688A000-memory.dmp
memory/1272-1-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/1272-15-0x0000015FF6820000-0x0000015FF6860000-memory.dmp
memory/1272-12-0x0000015FF6790000-0x0000015FF67A9000-memory.dmp
memory/1272-9-0x0000015FF67B0000-0x0000015FF67C2000-memory.dmp
memory/1272-6-0x0000015FF66F0000-0x0000015FF6737000-memory.dmp
memory/1272-21-0x0000015FF67F0000-0x0000015FF6803000-memory.dmp
memory/1272-31-0x0000015FF6BB0000-0x0000015FF6C74000-memory.dmp
memory/1272-3-0x0000015FF6740000-0x0000015FF6781000-memory.dmp
memory/1272-24-0x0000015FF67E0000-0x0000015FF67E7000-memory.dmp
memory/4088-44-0x00007FFDE516F000-0x00007FFDE5170000-memory.dmp
memory/4088-45-0x0000000000900000-0x0000000000912000-memory.dmp
memory/4088-46-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/4088-47-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/4088-48-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp