neptunerat | 0868ade302ddc24703049e4274d51c6f0295e4007ed4de11c910ee5a40f44ec0 | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/09/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 48KB
Sample260915-v6pp3age99
SHA256 0868ade302ddc24703049e4274d51c6f0295e4007ed4de11c910ee5a40f44ec0
MD5 c69d483b5b57136159447f8e998417d1
SHA1 f9c58a07086d9789acc66eca17e271fc8bf23b4c
SHA512 ffbcea56a18b078a8674ee0725ea92f9312ab6c3409aff7d4d6460d60ec5c1c9cfffe1d0d71dd8dff6fe60e093fad216d7294eb00ca3ce2139085c61e9b0fc82
SSDEEP 1536:9bk9niyiiwRejSyAy/FXyK5EijqkPJWemOrCkmrCkqrCkhrCkgrCkFDGEl1bya9C:9bkZiyiiwRejSyAy/FXyK5EijqkPJWe3
TLSH
T15B23F99DA7E54111DAEF9EF01CB3C201D3B1AAA78926C52F6CD801CB2757B9886017F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution neptunerat xworm persistence rat trojan

Malware Config

Extracted

Family

neptunerat

C2

89.190.158.37:911

Attributes

filename
USB.exe
group
<Neptune>
key
3C62Outx4Gy0Zewc
rat_name
<123456789>

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/4988-0-0x0000000000D40000-0x0000000000D52000-memory.dmp	family_xworm
behavioral1/files/0x0008000000028528-2.dat	family_xworm

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral1/memory/4988-0-0x0000000000D40000-0x0000000000D52000-memory.dmp	family_neptunerat
behavioral1/files/0x0008000000028528-2.dat	family_neptunerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000\Control Panel\International\Geo\Nation	MasonClient.exe

Executes dropped EXE 4 IoCs

pid	Process
1240	MasonClient.exe
1576	MasonClient.exe
2472	MasonClient.exe
1692	MasonClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MasonClient = "C:\\Users\\Admin\\AppData\\Roaming\\MasonClient.exe"	MasonClient.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2244	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	MasonClient.exe
Token: SeDebugPrivilege	1240	MasonClient.exe
Token: SeDebugPrivilege	1576	MasonClient.exe
Token: SeDebugPrivilege	2472	MasonClient.exe
Token: SeDebugPrivilege	1692	MasonClient.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2244	4988	MasonClient.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2244

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
Size 654B
SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
MD5 11c6e74f0561678d2cf7fc075a6cc00c
SHA1 535ee79ba978554abcb98c566235805e7ea18490
SHA512 32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0
TLSH
T136F0783432A2E1D5C9127F111C1D298452AF8386B6A0AF1C7A68935DD8261376F313F3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 48KB
SHA256 0868ade302ddc24703049e4274d51c6f0295e4007ed4de11c910ee5a40f44ec0
MD5 c69d483b5b57136159447f8e998417d1
SHA1 f9c58a07086d9789acc66eca17e271fc8bf23b4c
SHA512 ffbcea56a18b078a8674ee0725ea92f9312ab6c3409aff7d4d6460d60ec5c1c9cfffe1d0d71dd8dff6fe60e093fad216d7294eb00ca3ce2139085c61e9b0fc82
SSDEEP 1536:9bk9niyiiwRejSyAy/FXyK5EijqkPJWemOrCkmrCkqrCkhrCkgrCkFDGEl1bya9C:9bkZiyiiwRejSyAy/FXyK5EijqkPJWe3
TLSH
T15B23F99DA7E54111DAEF9EF01CB3C201D3B1AAA78926C52F6CD801CB2757B9886017F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4988-0-0x0000000000D40000-0x0000000000D52000-memory.dmp

Download

memory/4988-1-0x000000001BB20000-0x000000001BB30000-memory.dmp

Download

memory/4988-4-0x000000001BB20000-0x000000001BB30000-memory.dmp

Download