njrat | 29a6a87aa18866c3e0973e9f5fc8cda9342471ac312c88e2350e9568be7a375b

Analysis

user interaction
yes
max time kernel
133s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OctopusEAX.exe
Size 55KB
Sample260930-tnrahazdkd
SHA256 29a6a87aa18866c3e0973e9f5fc8cda9342471ac312c88e2350e9568be7a375b
MD5 4d4caa28d971f30a781e43f3316800a8
SHA1 3506f15584f3e78e791fef784bf8fd1b660fb9f9
SHA512 f38f11978a1111db0c3f7a9cd9dc8e4f9434862ed6c224030ae34777a64aafe895337391d3fbdca5bc423e0e0521872a7f17b63cea45e2f2b9d3497d8e9a4307
SSDEEP 1536:yQtIDnrNZ9Ly3OIDKwsNMDFXExI3pmmm:hIDnhe+IDKwsNMDFXExI3pm
TLSH
T148432844BFEA4A01E2BD8F3468F655150A34AA63E532EB1F4CD668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution njrat persistence privilege_escalation spyware trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ada9dba76d6c3339f93a7733887b2c05.exe	OctopusEAX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ada9dba76d6c3339f93a7733887b2c05.exe	OctopusEAX.exe

Executes dropped EXE 4 IoCs

pid	Process
4144	f19c5d3164db47c6a07bbb14c2607ea2.exe
5696	MasonMBR-S.exe
1184	MasonGDI.exe
1412	MasonRootkit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OctopusEAX.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctopusEAX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3808	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe
1412	MasonRootkit.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: 33	5240	OctopusEAX.exe
Token: SeIncBasePriorityPrivilege	5240	OctopusEAX.exe
Token: SeDebugPrivilege	1412	MasonRootkit.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: 33	5108	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5108	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 5600	5240	OctopusEAX.exe	90
PID 5600 wrote to memory of 3808	5600	cmd.exe	92
PID 5240 wrote to memory of 4144	5240	OctopusEAX.exe	95
PID 4144 wrote to memory of 5496	4144	f19c5d3164db47c6a07bbb14c2607ea2.exe	96
PID 4144 wrote to memory of 5696	4144	f19c5d3164db47c6a07bbb14c2607ea2.exe	98
PID 4144 wrote to memory of 1184	4144	f19c5d3164db47c6a07bbb14c2607ea2.exe	99
PID 4144 wrote to memory of 1412	4144	f19c5d3164db47c6a07bbb14c2607ea2.exe	100
PID 1412 wrote to memory of 740	1412	MasonRootkit.exe	5
PID 1412 wrote to memory of 984	1412	MasonRootkit.exe	9
PID 1412 wrote to memory of 988	1412	MasonRootkit.exe	10
PID 1412 wrote to memory of 1000	1412	MasonRootkit.exe	11
PID 1412 wrote to memory of 1028	1412	MasonRootkit.exe	13
PID 1412 wrote to memory of 1136	1412	MasonRootkit.exe	14
PID 1412 wrote to memory of 1208	1412	MasonRootkit.exe	15
PID 1412 wrote to memory of 1280	1412	MasonRootkit.exe	16
PID 1412 wrote to memory of 1320	1412	MasonRootkit.exe	17
PID 1412 wrote to memory of 1352	1412	MasonRootkit.exe	18
PID 1412 wrote to memory of 1544	1412	MasonRootkit.exe	22
PID 1412 wrote to memory of 1604	1412	MasonRootkit.exe	23
PID 1412 wrote to memory of 1644	1412	MasonRootkit.exe	24
PID 1412 wrote to memory of 1768	1412	MasonRootkit.exe	25
PID 1412 wrote to memory of 1816	1412	MasonRootkit.exe	26
PID 1412 wrote to memory of 1824	1412	MasonRootkit.exe	27
PID 1412 wrote to memory of 1996	1412	MasonRootkit.exe	28
PID 1412 wrote to memory of 1536	1412	MasonRootkit.exe	29
PID 1412 wrote to memory of 1840	1412	MasonRootkit.exe	30
PID 1412 wrote to memory of 1192	1412	MasonRootkit.exe	31
PID 1412 wrote to memory of 2072	1412	MasonRootkit.exe	32
PID 1412 wrote to memory of 2216	1412	MasonRootkit.exe	33
PID 1412 wrote to memory of 2260	1412	MasonRootkit.exe	34
PID 1412 wrote to memory of 2316	1412	MasonRootkit.exe	35
PID 1412 wrote to memory of 2392	1412	MasonRootkit.exe	36
PID 1412 wrote to memory of 2436	1412	MasonRootkit.exe	37
PID 1412 wrote to memory of 2548	1412	MasonRootkit.exe	38
PID 1412 wrote to memory of 2692	1412	MasonRootkit.exe	39
PID 1412 wrote to memory of 2732	1412	MasonRootkit.exe	40
PID 1412 wrote to memory of 2764	1412	MasonRootkit.exe	41
PID 1412 wrote to memory of 2892	1412	MasonRootkit.exe	42
PID 1412 wrote to memory of 2992	1412	MasonRootkit.exe	43
PID 1412 wrote to memory of 3060	1412	MasonRootkit.exe	44
PID 1412 wrote to memory of 2716	1412	MasonRootkit.exe	45
PID 1412 wrote to memory of 3176	1412	MasonRootkit.exe	47
PID 1412 wrote to memory of 3184	1412	MasonRootkit.exe	48
PID 1412 wrote to memory of 3460	1412	MasonRootkit.exe	50
PID 1412 wrote to memory of 3560	1412	MasonRootkit.exe	51
PID 1412 wrote to memory of 3576	1412	MasonRootkit.exe	52
PID 1412 wrote to memory of 3640	1412	MasonRootkit.exe	53
PID 1412 wrote to memory of 3652	1412	MasonRootkit.exe	54
PID 1412 wrote to memory of 3664	1412	MasonRootkit.exe	55
PID 1412 wrote to memory of 3688	1412	MasonRootkit.exe	56
PID 1412 wrote to memory of 3260	1412	MasonRootkit.exe	57
PID 1412 wrote to memory of 1292	1412	MasonRootkit.exe	58
PID 1412 wrote to memory of 4348	1412	MasonRootkit.exe	59
PID 1412 wrote to memory of 4396	1412	MasonRootkit.exe	60
PID 1412 wrote to memory of 4436	1412	MasonRootkit.exe	61
PID 1412 wrote to memory of 4656	1412	MasonRootkit.exe	62
PID 1412 wrote to memory of 4720	1412	MasonRootkit.exe	63
PID 1412 wrote to memory of 4988	1412	MasonRootkit.exe	64
PID 1412 wrote to memory of 5124	1412	MasonRootkit.exe	65
PID 1412 wrote to memory of 5192	1412	MasonRootkit.exe	66
PID 1412 wrote to memory of 5228	1412	MasonRootkit.exe	67
PID 1412 wrote to memory of 5608	1412	MasonRootkit.exe	70
PID 1412 wrote to memory of 4444	1412	MasonRootkit.exe	73
PID 1412 wrote to memory of 4740	1412	MasonRootkit.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:984
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1208

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:988

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a0f6bcd4-f19a-4f26-8f7f-2fbccd6f4107 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-367b9fc1-d2e6-44ff-8830-7ef3e2396056 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bc1f9a8d-9714-40e6-ac61-2e5619b5c009 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-564562a8-d440-46d9-b60a-371a3dedb084 -LifetimeId:5a99a258-62f7-4370-a579-527f084088b9 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1536
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1372
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
      "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
      4⤵
      Creates a file in the Startup directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c taskkill /f /im Wireshark.exe
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5600
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Wireshark.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\f19c5d3164db47c6a07bbb14c2607ea2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f19c5d3164db47c6a07bbb14c2607ea2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4144
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"
        6⤵
        Executes dropped EXE
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2392
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2436
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3184

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4720

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5124

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2356

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 147KB
SHA256 24f189af6d0c0af7dbdbf230183423d34d9cc3c06f55fa911145dcc19e3a6eb6
MD5 fd138f51961f3071e135dae4e279ca7d
SHA1 63a107425ab4b3515b4c6545076ac6721a459717
SHA512 f0d596ebe25c89907018f4d5ca4635df28c7f7095c81bd4d6f6b0819301bd113fb2469d643c02b5d41f2ce523e8539c1a97a817160ee0074d6e1f0a7951e7804
SSDEEP 3072:6NLBkRkkil8Wq1bQKn+D1LZc3CCT3aD+3V7t8OaahrpLfc:6NLG39Toc3CCT38m7t8OPdR
TLSH
T196E3124596808060EB07BE3ECAF7C15257FAF34AAD92BD5F5EBA1E243D34B4158B4312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-S.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
Size 58KB
SHA256 34c657218a5d7702de283691e868f61c1f50ffcd9e6c6bd3f0336bda904975aa
MD5 1b120dcde4b7be948179d53257c71423
SHA1 efd894e18d8d9eb8b0af9e8eeaa0d44be04a7b62
SHA512 fb5ac3cdc836926919710edb15f0e4cb54a72f74122566ac2a965efb1b36daa94cdf01b4b984203d0d4c0deb0791f65d20d675029b40fa7e1baafd3194e4dbfe
SSDEEP 1536:0Xk0xKAR8NpSniWGpBZDOi23gkSH6MH/Rkexit:V0Gii3HEi2wkyHiSit
TLSH
T17B43F151E7DE01E3D31C4BF00D2311D752BAD719DD23A72E599CF2274F5B01E822A69A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f19c5d3164db47c6a07bbb14c2607ea2.exe

Path C:\Users\Admin\AppData\Local\Temp\f19c5d3164db47c6a07bbb14c2607ea2.exe
Size 482KB
SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
MD5 85e11c1d67aec0150757e3255d8231b7
SHA1 9167c5ea4a23d59f38e82f128f2b1a2dbbd88cea
SHA512 a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51
SSDEEP 12288:IJvK+727xaxunsCoFJse5vKNkuCCT3X7t8OP:IJKDAxuPondKNHj7hP
TLSH
T1E9A42382B21AE061E2CAF43727BD7A9273F6B0136352F91F51688A213D35FC0977525D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-54-0x000001734ACB0000-0x000001734ACD5000-memory.dmp

Download

memory/740-55-0x000001734ACE0000-0x000001734AD0B000-memory.dmp

Download

memory/740-56-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/984-60-0x000002C1D87E0000-0x000002C1D880B000-memory.dmp

Download

memory/984-61-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/988-63-0x00000258321E0000-0x000002583220B000-memory.dmp

Download

memory/988-64-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1000-134-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1000-133-0x000002CEE2150000-0x000002CEE217B000-memory.dmp

Download

memory/1136-137-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1136-136-0x000002A9435B0000-0x000002A9435DB000-memory.dmp

Download

memory/1184-68-0x0000000005D10000-0x0000000005DA2000-memory.dmp

Download

memory/1184-53-0x00000000007F0000-0x000000000081A000-memory.dmp

Download

memory/1192-166-0x000001B809000000-0x000001B80902B000-memory.dmp

Download

memory/1192-167-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1208-73-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1208-72-0x000001E1D09B0000-0x000001E1D09DB000-memory.dmp

Download

memory/1280-139-0x0000017504BA0000-0x0000017504BCB000-memory.dmp

Download

memory/1280-140-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1320-142-0x000001ECBB030000-0x000001ECBB05B000-memory.dmp

Download

memory/1320-143-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1352-145-0x000001EBEBDB0000-0x000001EBEBDDB000-memory.dmp

Download

memory/1412-52-0x00007FF838420000-0x00007FF8384E7000-memory.dmp

Download

memory/1412-51-0x00007FF839180000-0x00007FF8393E3000-memory.dmp

Download

memory/1536-162-0x000001639E4A0000-0x000001639E4CB000-memory.dmp

Download

memory/1544-82-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1544-81-0x00000172B0830000-0x00000172B085B000-memory.dmp

Download

memory/1604-146-0x00000119E5D80000-0x00000119E5DAB000-memory.dmp

Download

memory/1644-148-0x0000022C7DB70000-0x0000022C7DB9B000-memory.dmp

Download

memory/1644-149-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1768-151-0x0000017C37A10000-0x0000017C37A3B000-memory.dmp

Download

memory/1768-152-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1816-154-0x000001EBEA5E0000-0x000001EBEA60B000-memory.dmp

Download

memory/1816-155-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1824-157-0x000001C30CFD0000-0x000001C30CFFB000-memory.dmp

Download

memory/1840-163-0x000001EE4FE30000-0x000001EE4FE5B000-memory.dmp

Download

memory/1840-164-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/1996-158-0x000001DE9CC50000-0x000001DE9CC7B000-memory.dmp

Download

memory/1996-159-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2072-170-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2072-169-0x00000266FEB00000-0x00000266FEB2B000-memory.dmp

Download

memory/2216-173-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2216-172-0x000001B809950000-0x000001B80997B000-memory.dmp

Download

memory/2260-174-0x0000018E2F960000-0x0000018E2F98B000-memory.dmp

Download

memory/2260-176-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2316-179-0x00000255E17D0000-0x00000255E17FB000-memory.dmp

Download

memory/2316-182-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2392-178-0x0000018934950000-0x000001893497B000-memory.dmp

Download

memory/2392-180-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2436-184-0x000002D7A02B0000-0x000002D7A02DB000-memory.dmp

Download

memory/2548-185-0x000001188EC10000-0x000001188EC3B000-memory.dmp

Download

memory/2716-201-0x0000000001350000-0x000000000137B000-memory.dmp

Download

memory/2716-202-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2732-187-0x0000027DCF610000-0x0000027DCF63B000-memory.dmp

Download

memory/2764-190-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2764-188-0x000001DDF0390000-0x000001DDF03BB000-memory.dmp

Download

memory/2892-193-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/2892-192-0x00000139D29F0000-0x00000139D2A1B000-memory.dmp

Download

memory/2992-195-0x000001763FCE0000-0x000001763FD0B000-memory.dmp

Download

memory/2992-196-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/3060-199-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/3060-198-0x00000179D2F50000-0x00000179D2F7B000-memory.dmp

Download

memory/3176-204-0x000001E01BF80000-0x000001E01BFAB000-memory.dmp

Download

memory/3184-205-0x0000028F3DEF0000-0x0000028F3DF1B000-memory.dmp

Download

memory/4144-18-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/4144-16-0x00007FF81878F000-0x00007FF818790000-memory.dmp

Download

memory/4144-17-0x0000000000E70000-0x0000000000EEE000-memory.dmp

Download

memory/4144-19-0x00000000017A0000-0x00000000017F6000-memory.dmp

Download

memory/4144-20-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/4144-66-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/4988-122-0x000001EE5E140000-0x000001EE5E16B000-memory.dmp

Download

memory/4988-123-0x00007FF7F92C0000-0x00007FF7F92D0000-memory.dmp

Download

memory/5240-4-0x0000000075280000-0x00000000758A1000-memory.dmp

Download

memory/5240-5-0x0000000075280000-0x00000000758A1000-memory.dmp

Download

memory/5240-1-0x0000000075282000-0x0000000075284000-memory.dmp

Download

memory/5240-3-0x0000000075282000-0x0000000075284000-memory.dmp

Download

memory/5240-2-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/5240-0-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/5696-38-0x0000000000210000-0x0000000000224000-memory.dmp

Download