Analysis
- max time kernel
2s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/09/2026, 02:49
Errors
General
- Target Magellan.exe
- Size 167KB
- Sample260915-da8dvsbn8z
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Magellan.exe"C:\Users\Admin\AppData\Local\Temp\Magellan.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x2441⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR.exe
MasonRootkit.exe
memory/464-46-0x000001CD00AA0000-0x000001CD00ACB000-memory.dmp
memory/464-47-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/608-35-0x000002AFBD1D0000-0x000002AFBD1F5000-memory.dmp
memory/608-36-0x000002AFBD200000-0x000002AFBD22B000-memory.dmp
memory/608-37-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/664-40-0x0000020461B30000-0x0000020461B5B000-memory.dmp
memory/664-41-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/880-50-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/880-49-0x0000014F52540000-0x0000014F5256B000-memory.dmp
memory/940-57-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/940-56-0x000001C403510000-0x000001C40353B000-memory.dmp
memory/1008-53-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1008-52-0x000001C3FDF30000-0x000001C3FDF5B000-memory.dmp
memory/1088-65-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1088-64-0x0000022B90690000-0x0000022B906BB000-memory.dmp
memory/1092-68-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1092-67-0x000001C004E60000-0x000001C004E8B000-memory.dmp
memory/1152-71-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1152-70-0x0000015200230000-0x000001520025B000-memory.dmp
memory/1236-28-0x00007FF806D10000-0x00007FF806F05000-memory.dmp
memory/1236-29-0x00007FF806020000-0x00007FF8060DE000-memory.dmp
memory/1272-74-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1272-73-0x00000287936B0000-0x00000287936DB000-memory.dmp
memory/1280-77-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1280-76-0x000002003E670000-0x000002003E69B000-memory.dmp
memory/1324-81-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1324-80-0x000001F2F39C0000-0x000001F2F39EB000-memory.dmp
memory/1392-84-0x0000014895980000-0x00000148959AB000-memory.dmp
memory/1392-85-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1400-89-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1400-88-0x00000218B2F30000-0x00000218B2F5B000-memory.dmp
memory/1432-114-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1432-113-0x000002169A0F0000-0x000002169A11B000-memory.dmp
memory/1480-146-0x000001D6E50F0000-0x000001D6E511B000-memory.dmp
memory/1480-147-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1484-143-0x000001EB51090000-0x000001EB510BB000-memory.dmp
memory/1484-144-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1524-117-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1524-116-0x0000026A197B0000-0x0000026A197DB000-memory.dmp
memory/1596-120-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1596-119-0x00000245BB990000-0x00000245BB9BB000-memory.dmp
memory/1616-123-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1616-122-0x00000192E07C0000-0x00000192E07EB000-memory.dmp
memory/1652-125-0x0000020BF1A00000-0x0000020BF1A2B000-memory.dmp
memory/1652-126-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1812-129-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1812-128-0x00000171A3490000-0x00000171A34BB000-memory.dmp
memory/1860-132-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1860-131-0x000001A827170000-0x000001A82719B000-memory.dmp
memory/1880-135-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1880-134-0x000001D860690000-0x000001D8606BB000-memory.dmp
memory/1916-150-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1916-149-0x000001BC9AD20000-0x000001BC9AD4B000-memory.dmp
memory/1972-137-0x000001300BFA0000-0x000001300BFCB000-memory.dmp
memory/1972-138-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/1980-140-0x000002BC00EC0000-0x000002BC00EEB000-memory.dmp
memory/1980-141-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/2040-152-0x0000020F538E0000-0x0000020F5390B000-memory.dmp
memory/2040-153-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/2140-155-0x0000000001370000-0x000000000139B000-memory.dmp
memory/2140-156-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/2224-158-0x000001A75C7D0000-0x000001A75C7FB000-memory.dmp
memory/2224-159-0x00007FF7C6D90000-0x00007FF7C6DA0000-memory.dmp
memory/2404-161-0x0000022090D70000-0x0000022090D9B000-memory.dmp
memory/3444-23-0x0000000000230000-0x0000000000238000-memory.dmp
memory/4760-0-0x00000000007D0000-0x0000000000800000-memory.dmp
memory/4760-2-0x0000000002760000-0x0000000002786000-memory.dmp
memory/4760-1-0x000000001B450000-0x000000001B460000-memory.dmp