Analysis
- user interaction
yes - max time kernel
24s - max time network
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 15:17
Errors
General
- Target 2345678.exe
- Size 49KB
- Sample260910-spc9lade74
- SHA256 e24c965ec3e244afe123a9254dc1d54545b0fa64601c03850f71c4436838085f
Malware Config
Extracted
-
neptunerat
-
p8mfbrn1en.localto.net:8521
-
filename
USB.exe
-
group
MasonGroup
-
key
GIq4yVIhlqclejjH
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 1 IoCs
- Executes dropped EXE 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2345678.exe"C:\Users\Admin\AppData\Local\Temp\2345678.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp55C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp55C7.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\MatrixMBR.exe"C:\Windows\System32\MatrixMBR.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\GDI.exe"C:\Users\Admin\AppData\Local\Temp\GDI.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GDI.exe
MBR.exe
MBR2.exe
TROLL2.exe
TROLL5.exe
tmp55C7.tmp.exe
MatrixMBR.exe
memory/2120-90-0x00000000003E0000-0x00000000003E8000-memory.dmp
memory/2560-65-0x0000000004E40000-0x0000000004E4A000-memory.dmp
memory/2560-64-0x0000000004DA0000-0x0000000004E32000-memory.dmp
memory/2560-63-0x0000000005490000-0x0000000005A4A000-memory.dmp
memory/2560-62-0x00000000001D0000-0x0000000000288000-memory.dmp
memory/2852-10-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-0-0x00007FFD0D2DF000-0x00007FFD0D2E0000-memory.dmp
memory/2852-14-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-15-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-12-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-1-0x0000000000240000-0x0000000000252000-memory.dmp
memory/2852-25-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-2-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-13-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-28-0x000000001B0B0000-0x000000001B0BE000-memory.dmp
memory/2852-3-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-7-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-5-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-11-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-8-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-4-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-6-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/2852-9-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/3388-75-0x0000000000FF0000-0x0000000001036000-memory.dmp
memory/3696-47-0x0000000000930000-0x000000000096A000-memory.dmp
memory/4112-76-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4416-27-0x000000001B780000-0x000000001B864000-memory.dmp
memory/4416-61-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-48-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-33-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-32-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-29-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-26-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp
memory/4416-24-0x0000000000900000-0x00000000009EC000-memory.dmp