Analysis
- max time kernel
3s - max time network
5s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 17:53
Errors
General
- Target Magellan.exe
- Size 167KB
- Sample260910-wgdf6swtcy
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Magellan.exe"C:\Users\Admin\AppData\Local\Temp\Magellan.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x3001⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR.exe
MasonRootkit.exe
memory/396-48-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/396-47-0x000001AE6BAC0000-0x000001AE6BAEB000-memory.dmp
memory/536-0-0x00000000008E0000-0x0000000000910000-memory.dmp
memory/536-2-0x00000000010B0000-0x00000000010D6000-memory.dmp
memory/536-1-0x000000001B8A0000-0x000000001B8B0000-memory.dmp
memory/624-36-0x00000221F0B80000-0x00000221F0BA5000-memory.dmp
memory/624-37-0x00000221F0BB0000-0x00000221F0BDB000-memory.dmp
memory/624-38-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/680-42-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/680-41-0x000001BEB4FA0000-0x000001BEB4FCB000-memory.dmp
memory/880-50-0x0000018042D30000-0x0000018042D5B000-memory.dmp
memory/880-51-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/888-57-0x0000018FE4710000-0x0000018FE473B000-memory.dmp
memory/888-58-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1020-54-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1020-53-0x000001A217D10000-0x000001A217D3B000-memory.dmp
memory/1056-62-0x000001261C760000-0x000001261C78B000-memory.dmp
memory/1056-63-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1136-66-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1136-65-0x000002362BEF0000-0x000002362BF1B000-memory.dmp
memory/1148-71-0x00000114A8060000-0x00000114A808B000-memory.dmp
memory/1148-72-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1232-75-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1232-74-0x000001FC0EBD0000-0x000001FC0EBFB000-memory.dmp
memory/1244-19-0x0000000000610000-0x0000000000618000-memory.dmp
memory/1244-28-0x0000000005050000-0x0000000005060000-memory.dmp
memory/1256-78-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1256-77-0x000001B2F8320000-0x000001B2F834B000-memory.dmp
memory/1272-81-0x00000244203C0000-0x00000244203EB000-memory.dmp
memory/1272-82-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1320-86-0x0000028AEA780000-0x0000028AEA7AB000-memory.dmp
memory/1320-87-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1380-90-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1380-89-0x00000202A1890000-0x00000202A18BB000-memory.dmp
memory/1448-146-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1448-145-0x000002BB93130000-0x000002BB9315B000-memory.dmp
memory/1500-116-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1500-115-0x000001CB75F60000-0x000001CB75F8B000-memory.dmp
memory/1508-149-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1508-148-0x000001940FD60000-0x000001940FD8B000-memory.dmp
memory/1516-29-0x00007FF8AE330000-0x00007FF8AE525000-memory.dmp
memory/1516-30-0x00007FF8AE0A0000-0x00007FF8AE15E000-memory.dmp
memory/1560-119-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1560-118-0x00000212D7330000-0x00000212D735B000-memory.dmp
memory/1612-122-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1612-121-0x0000025941590000-0x00000259415BB000-memory.dmp
memory/1624-125-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1624-124-0x000001F4FB890000-0x000001F4FB8BB000-memory.dmp
memory/1636-127-0x00000288E47B0000-0x00000288E47DB000-memory.dmp
memory/1636-128-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1796-131-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1796-130-0x0000023172560000-0x000002317258B000-memory.dmp
memory/1836-134-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1836-133-0x000001A852760000-0x000001A85278B000-memory.dmp
memory/1848-151-0x000001EA31AF0000-0x000001EA31B1B000-memory.dmp
memory/1848-152-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1864-137-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1864-136-0x000001F206740000-0x000001F20676B000-memory.dmp
memory/1956-140-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1956-139-0x0000027A153D0000-0x0000027A153FB000-memory.dmp
memory/1964-143-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/1964-142-0x0000024BA74D0000-0x0000024BA74FB000-memory.dmp
memory/2052-154-0x000001F6AB3C0000-0x000001F6AB3EB000-memory.dmp
memory/2052-155-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/2172-157-0x0000000001620000-0x000000000164B000-memory.dmp
memory/2172-158-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/2316-160-0x00000230E7760000-0x00000230E778B000-memory.dmp
memory/2316-161-0x00007FF86E3B0000-0x00007FF86E3C0000-memory.dmp
memory/2332-163-0x0000026CDAF80000-0x0000026CDAFAB000-memory.dmp