donutloader | 69f7cfc10aa1a343defd5e3304c10d581cbf54cfd525cf4ffb0b03e82449413b

Analysis

max time kernel
58s
max time network
60s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/09/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient12f_Slayed-cleaned.exe
Size 1.6MB
Sample260927-l2ymqswwft
SHA256 69f7cfc10aa1a343defd5e3304c10d581cbf54cfd525cf4ffb0b03e82449413b
MD5 fd0a6350adbb7354f028d1df41389873
SHA1 008120f3bdbe37fab6c7d5f09d3e9de843a64ee5
SHA512 84feac9b1d8cee2947b849e51f1abfe0742719084cd6812a503d6477bff05fc7da5bbbf6e9b8add053bc6a39bdf983de78f39f36140c9d8199f8a77f91251735
SSDEEP 24576:g41yJjxmUzyD5ctmj7RdfmdhMq6E+m+rr6O67Ies2CQQMk/jtjJzaXb:TwRv2ee7vfA3K61Ues2D+/jtjJzaXb
TLSH
T1C985338A0559F981C0AD53753E6E86C29B1CF3B3AB903B27F44317AD772B21F5115D88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader neptunerat loader persistence privilege_escalation trojan

Malware Config

Extracted

Family

neptunerat

ggge24x-54659.portmap.host:54659

Attributes

filename
USB.exe
group
MasonGroup
key
mvGDfjkSasL53WcZ
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4844-1-0x000000001D150000-0x000000001D2F0000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/4844-4-0x000000001D890000-0x000000001DA2E000-memory.dmp	family_neptunerat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4824 created 632	4824	MasonRootkit.exe	5

Executes dropped EXE 5 IoCs

pid	Process
1592	MasonKit.exe
3816	MasonMasonClient12f_Slayed-cleaned.exe
4824	MasonRootkit.exe
4596	MasonMasonClient12f_Slayed-cleaned.exe
3640	MasonMasonClient12f_Slayed-cleaned.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\MasonMasonClient12f_Slayed-cleaned = "C:\\Users\\Admin\\AppData\\Roaming\\MasonMasonClient12f_Slayed-cleaned.exe"	MasonMasonClient12f_Slayed-cleaned.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 2280	4824	MasonRootkit.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1752	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MasonMasonClient12f_Slayed-cleaned.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MasonMasonClient12f_Slayed-cleaned.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3472	timeout.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790503399"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 26 Sep 2026 19:34:56 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={8EEFE8B8-2932-49E5-B113-5692A381901D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4824	MasonRootkit.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3192	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	MasonClient12f_Slayed-cleaned.exe
Token: SeDebugPrivilege	4824	MasonRootkit.exe
Token: SeDebugPrivilege	4824	MasonRootkit.exe
Token: SeDebugPrivilege	2280	dllhost.exe
Token: SeDebugPrivilege	3816	MasonMasonClient12f_Slayed-cleaned.exe
Token: SeDebugPrivilege	4596	MasonMasonClient12f_Slayed-cleaned.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	3640	MasonMasonClient12f_Slayed-cleaned.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE
3192	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1592	4844	MasonClient12f_Slayed-cleaned.exe	81
PID 4844 wrote to memory of 3816	4844	MasonClient12f_Slayed-cleaned.exe	82
PID 1592 wrote to memory of 4824	1592	MasonKit.exe	83
PID 1592 wrote to memory of 1752	1592	MasonKit.exe	84
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 4824 wrote to memory of 2280	4824	MasonRootkit.exe	86
PID 3816 wrote to memory of 536	3816	MasonMasonClient12f_Slayed-cleaned.exe	87
PID 1752 wrote to memory of 3472	1752	cmd.exe	89
PID 2280 wrote to memory of 632	2280	dllhost.exe	5
PID 2280 wrote to memory of 696	2280	dllhost.exe	7
PID 2280 wrote to memory of 896	2280	dllhost.exe	11
PID 2280 wrote to memory of 408	2280	dllhost.exe	13
PID 2280 wrote to memory of 768	2280	dllhost.exe	14
PID 2280 wrote to memory of 420	2280	dllhost.exe	15
PID 2280 wrote to memory of 1088	2280	dllhost.exe	16
PID 2280 wrote to memory of 1124	2280	dllhost.exe	17
PID 2280 wrote to memory of 1196	2280	dllhost.exe	19
PID 2280 wrote to memory of 1208	2280	dllhost.exe	20
PID 2280 wrote to memory of 1252	2280	dllhost.exe	21
PID 2280 wrote to memory of 1292	2280	dllhost.exe	22
PID 2280 wrote to memory of 1320	2280	dllhost.exe	23
PID 2280 wrote to memory of 1360	2280	dllhost.exe	24
PID 2280 wrote to memory of 1532	2280	dllhost.exe	25
PID 2280 wrote to memory of 1580	2280	dllhost.exe	26
PID 2280 wrote to memory of 1596	2280	dllhost.exe	27
PID 2280 wrote to memory of 1700	2280	dllhost.exe	28
PID 2280 wrote to memory of 1720	2280	dllhost.exe	29
PID 2280 wrote to memory of 1860	2280	dllhost.exe	30
PID 2280 wrote to memory of 1904	2280	dllhost.exe	31
PID 2280 wrote to memory of 1932	2280	dllhost.exe	32
PID 2280 wrote to memory of 2016	2280	dllhost.exe	33
PID 2280 wrote to memory of 2032	2280	dllhost.exe	34
PID 2280 wrote to memory of 2144	2280	dllhost.exe	35
PID 2280 wrote to memory of 2152	2280	dllhost.exe	36
PID 2280 wrote to memory of 2240	2280	dllhost.exe	37
PID 2280 wrote to memory of 2268	2280	dllhost.exe	38
PID 2280 wrote to memory of 2348	2280	dllhost.exe	39
PID 2280 wrote to memory of 2460	2280	dllhost.exe	41
PID 2280 wrote to memory of 2536	2280	dllhost.exe	42
PID 2280 wrote to memory of 2668	2280	dllhost.exe	43
PID 2280 wrote to memory of 2672	2280	dllhost.exe	44
PID 2280 wrote to memory of 2724	2280	dllhost.exe	45
PID 2280 wrote to memory of 2752	2280	dllhost.exe	46
PID 2280 wrote to memory of 2812	2280	dllhost.exe	48
PID 2280 wrote to memory of 2832	2280	dllhost.exe	49
PID 2280 wrote to memory of 2840	2280	dllhost.exe	50
PID 2280 wrote to memory of 2936	2280	dllhost.exe	51
PID 2280 wrote to memory of 1064	2280	dllhost.exe	52
PID 2280 wrote to memory of 784	2280	dllhost.exe	53
PID 2280 wrote to memory of 3192	2280	dllhost.exe	54
PID 2280 wrote to memory of 3328	2280	dllhost.exe	55
PID 2280 wrote to memory of 3376	2280	dllhost.exe	56
PID 2280 wrote to memory of 3704	2280	dllhost.exe	59
PID 2280 wrote to memory of 3788	2280	dllhost.exe	60
PID 2280 wrote to memory of 3848	2280	dllhost.exe	61
PID 2280 wrote to memory of 3932	2280	dllhost.exe	62
PID 2280 wrote to memory of 4244	2280	dllhost.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:768
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4fa73cce-e617-446f-a2dd-1d18558e0953}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2280

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-749d41de-32a0-414a-89d9-e47753c5f400 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-de827c71-5fe6-40e9-8acb-3deff2d52757 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dab86a11-389e-459f-8184-838f88f26a1c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fdc0aa15-df6d-4de1-ad5e-f304059f6a9b -LifetimeId:8301ee96-6a4a-412a-8af2-3dfeff3c486a -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1208
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:784
- C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
  C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1580
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2268

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1064

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3192
- C:\Users\Admin\AppData\Local\Temp\MasonClient12f_Slayed-cleaned.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonClient12f_Slayed-cleaned.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA89F.tmp.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3768
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3472
- - C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
    "C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonMasonClient12f_Slayed-cleaned" /tr "C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2132

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2024

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3016

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4760

C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonMasonClient12f_Slayed-cleaned.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonMasonClient12f_Slayed-cleaned.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonKit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
Size 595KB
SHA256 7596f8d9c6fca490a5d657b994c0399ce5197e41102c66fe296408f5b37bf3f1
MD5 75c6f68abba95ddfd287f61b827e2711
SHA1 5dbd72d6e361b6af2e89b2aa49d3b64bd81d71a1
SHA512 103c3d754f26c059876a7c835b7bb69401d38a7b42cde7878a25cf5f127a77657b00d9d03d3eecbc08237c79d497785b69fd31560127dd37758dbe32d77b2e11
SSDEEP 12288:fWVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D:eVOQj+dWID+yG+zIzy7VxflRGa+Ci
TLSH
T1E7D423BC22F8F19DD54DC9393BF7025A4221F52F5810A36227A459CD2EF382D8D8DE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 592KB
SHA256 8de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447
MD5 ae78843b23f7a1c65f6b9a5a031f1950
SHA1 a12aad340d3eafb919d6cf38fad402f29b570ed0
SHA512 648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5
SSDEEP 12288:jK6oSHxX1Yrpx/bdEU5lRM+QAYw5p2r7H1xMolRUQErVD7ATfuXLF4:jzoyWr/b2+DM+QA5zM7VxjlRUQeVDUr8
TLSH
T175D423691391F0AFE1D9953F3667030689305628AE83EBFA13ED48A67FF74D7094C684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA89F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA89F.tmp.bat
Size 160B
SHA256 0808b18d5bab422188ecf790a63b1ec50365e1c8d72ae10a9b299d722d97aa44
MD5 31faa3b37a85271635f8f8af79d61102
SHA1 67cf3db5b46763dbf9aa254dbd9f8ea286187bdd
SHA512 1d906ccf64568199c336f303b74cd64ee2d4181caac5ca83fb152bf8160d0638603c23b5a03e9c6c1769b383a55f113f55acd4069c73e22c895620dc9f500a9e
TLSH
T1D9C02B8014CEFB0B2A4E241711B6C09FC1735C0E3F407F50939880482A804BCF9F430A
MD5 SHA1 SHA512 TLSH

Submit Download

MasonMasonClient12f_Slayed-cleaned.exe

Path C:\Users\Admin\AppData\Roaming\MasonMasonClient12f_Slayed-cleaned.exe
Size 1.6MB
SHA256 69f7cfc10aa1a343defd5e3304c10d581cbf54cfd525cf4ffb0b03e82449413b
MD5 fd0a6350adbb7354f028d1df41389873
SHA1 008120f3bdbe37fab6c7d5f09d3e9de843a64ee5
SHA512 84feac9b1d8cee2947b849e51f1abfe0742719084cd6812a503d6477bff05fc7da5bbbf6e9b8add053bc6a39bdf983de78f39f36140c9d8199f8a77f91251735
SSDEEP 24576:g41yJjxmUzyD5ctmj7RdfmdhMq6E+m+rr6O67Ies2CQQMk/jtjJzaXb:TwRv2ee7vfA3K61Ues2D+/jtjJzaXb
TLSH
T1C985338A0559F981C0AD53753E6E86C29B1CF3B3AB903B27F44317AD772B21F5115D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-95-0x0000027E01880000-0x0000027E01A3B000-memory.dmp

Download

memory/408-98-0x0000027E01880000-0x0000027E01A3B000-memory.dmp

Download

memory/408-97-0x0000027E01880000-0x0000027E01A3B000-memory.dmp

Download

memory/408-96-0x0000027E01880000-0x0000027E01A3B000-memory.dmp

Download

memory/408-94-0x0000027E01880000-0x0000027E01A3B000-memory.dmp

Download

memory/408-99-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/420-102-0x0000022C5F740000-0x0000022C5F8FB000-memory.dmp

Download

memory/420-103-0x0000022C5F740000-0x0000022C5F8FB000-memory.dmp

Download

memory/420-104-0x0000022C5F740000-0x0000022C5F8FB000-memory.dmp

Download

memory/420-106-0x0000022C5F740000-0x0000022C5F8FB000-memory.dmp

Download

memory/420-105-0x0000022C5F740000-0x0000022C5F8FB000-memory.dmp

Download

memory/420-107-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/632-75-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/632-61-0x0000013BA3860000-0x0000013BA399E000-memory.dmp

Download

memory/632-74-0x0000013BA39A0000-0x0000013BA3B5B000-memory.dmp

Download

memory/632-72-0x0000013BA39A0000-0x0000013BA3B5B000-memory.dmp

Download

memory/632-71-0x0000013BA39A0000-0x0000013BA3B5B000-memory.dmp

Download

memory/632-73-0x0000013BA39A0000-0x0000013BA3B5B000-memory.dmp

Download

memory/632-62-0x0000013BA39A0000-0x0000013BA3B5B000-memory.dmp

Download

memory/696-67-0x000002990C3A0000-0x000002990C55B000-memory.dmp

Download

memory/696-69-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/696-64-0x000002990C3A0000-0x000002990C55B000-memory.dmp

Download

memory/696-65-0x000002990C3A0000-0x000002990C55B000-memory.dmp

Download

memory/696-66-0x000002990C3A0000-0x000002990C55B000-memory.dmp

Download

memory/696-68-0x000002990C3A0000-0x000002990C55B000-memory.dmp

Download

memory/768-88-0x0000017B25000000-0x0000017B251BB000-memory.dmp

Download

memory/768-92-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/768-91-0x0000017B25000000-0x0000017B251BB000-memory.dmp

Download

memory/768-90-0x0000017B25000000-0x0000017B251BB000-memory.dmp

Download

memory/768-89-0x0000017B25000000-0x0000017B251BB000-memory.dmp

Download

memory/768-87-0x0000017B25000000-0x0000017B251BB000-memory.dmp

Download

memory/896-82-0x000001A06B2F0000-0x000001A06B4AB000-memory.dmp

Download

memory/896-78-0x000001A06B2F0000-0x000001A06B4AB000-memory.dmp

Download

memory/896-79-0x000001A06B2F0000-0x000001A06B4AB000-memory.dmp

Download

memory/896-80-0x000001A06B2F0000-0x000001A06B4AB000-memory.dmp

Download

memory/896-81-0x000001A06B2F0000-0x000001A06B4AB000-memory.dmp

Download

memory/896-83-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/1088-115-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/1088-112-0x000001E610940000-0x000001E610AFB000-memory.dmp

Download

memory/1088-111-0x000001E610940000-0x000001E610AFB000-memory.dmp

Download

memory/1088-110-0x000001E610940000-0x000001E610AFB000-memory.dmp

Download

memory/1088-114-0x000001E610940000-0x000001E610AFB000-memory.dmp

Download

memory/1088-113-0x000001E610940000-0x000001E610AFB000-memory.dmp

Download

memory/1124-122-0x000001D5D8280000-0x000001D5D843B000-memory.dmp

Download

memory/1124-123-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/1124-118-0x000001D5D8280000-0x000001D5D843B000-memory.dmp

Download

memory/1124-119-0x000001D5D8280000-0x000001D5D843B000-memory.dmp

Download

memory/1124-120-0x000001D5D8280000-0x000001D5D843B000-memory.dmp

Download

memory/1124-121-0x000001D5D8280000-0x000001D5D843B000-memory.dmp

Download

memory/1196-128-0x00000283C2400000-0x00000283C25BB000-memory.dmp

Download

memory/1196-130-0x00000283C2400000-0x00000283C25BB000-memory.dmp

Download

memory/1196-129-0x00000283C2400000-0x00000283C25BB000-memory.dmp

Download

memory/1196-133-0x00007FFE8D010000-0x00007FFE8D020000-memory.dmp

Download

memory/1196-132-0x00000283C2400000-0x00000283C25BB000-memory.dmp

Download

memory/1196-131-0x00000283C2400000-0x00000283C25BB000-memory.dmp

Download

memory/1208-135-0x000002356FA80000-0x000002356FC3B000-memory.dmp

Download

memory/1592-22-0x00000000008A0000-0x000000000093C000-memory.dmp

Download

memory/2280-55-0x00007FFECCF80000-0x00007FFECD189000-memory.dmp

Download

memory/2280-58-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2280-54-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2280-56-0x00007FFECBB90000-0x00007FFECBC4D000-memory.dmp

Download

memory/2280-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4824-51-0x00007FFECBB90000-0x00007FFECBC4D000-memory.dmp

Download

memory/4824-48-0x000001A89F810000-0x000001A89F8AA000-memory.dmp

Download

memory/4824-49-0x00007FFECCF80000-0x00007FFECD189000-memory.dmp

Download

memory/4844-6-0x000000001D6E0000-0x000000001D6F0000-memory.dmp

Download

memory/4844-5-0x000000001D6E0000-0x000000001D6F0000-memory.dmp

Download

memory/4844-3-0x000000001D6E0000-0x000000001D6F0000-memory.dmp

Download

memory/4844-4-0x000000001D890000-0x000000001DA2E000-memory.dmp

Download

memory/4844-0-0x0000000000ED0000-0x0000000001078000-memory.dmp

Download

memory/4844-1-0x000000001D150000-0x000000001D2F0000-memory.dmp

Download