Analysis
- max time kernel
8s - max time network
11s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 17:53
Errors
General
- Target Magellan.exe
- Size 167KB
- Sample260910-wgdf6swtcy
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Malware Config
Signatures
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Magellan.exe"C:\Users\Admin\AppData\Local\Temp\Magellan.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000005081⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR.exe
MasonRootkit.exe
memory/752-42-0x000001E2D1670000-0x000001E2D169B000-memory.dmp
memory/752-43-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp
memory/972-47-0x00000240810E0000-0x000002408110B000-memory.dmp
memory/972-48-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp
memory/980-50-0x00000222AEB40000-0x00000222AEB6B000-memory.dmp
memory/980-51-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp
memory/2672-159-0x000001B237900000-0x000001B23792B000-memory.dmp
memory/2788-163-0x000001AC83AA0000-0x000001AC83ACB000-memory.dmp
memory/2788-164-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp
memory/2824-166-0x000001CAC8A60000-0x000001CAC8A8B000-memory.dmp
memory/2956-2-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-3-0x0000000002620000-0x0000000002646000-memory.dmp
memory/2956-19-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-21-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-38-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-5-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-4-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-8-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2956-0-0x00007FFD36F6F000-0x00007FFD36F70000-memory.dmp
memory/2956-1-0x00000000004D0000-0x0000000000500000-memory.dmp
memory/2956-9-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/3560-36-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp
memory/3560-37-0x00007FFD587A0000-0x00007FFD58867000-memory.dmp
memory/5548-23-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5548-22-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/5548-20-0x0000000000570000-0x0000000000578000-memory.dmp