donutloader | 63e383ea42523763482bf51da4861f0c6fc8592717f365e6ab846f88529bb0b5

Analysis

max time kernel
598s
max time network
605s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 78KB
Sample261001-mefdbaytaw
SHA256 63e383ea42523763482bf51da4861f0c6fc8592717f365e6ab846f88529bb0b5
MD5 ecc44cfe267b57284b01014c1d4a2f47
SHA1 d23dd597f88a60845a8008825625a4142b74a9c2
SHA512 969ea3f59002a835ae0d81ec32488bc62f2558490298585f9c05f2fa0a1176e5757e9819fa00fdcc38152477223e2dad0d12a3e7876b713954936d22d5a1f241
SSDEEP 1536:DAKcF0+RDfGFVUfO2ZPXG+6AoMwwjEhqMvbrVTF3xGFSqgZYytSXRxzBrD:1MjxfcUnlXXr1j0fpF3UrgZYytARxN
TLSH
T15E73D09F9BF68B6DE1CF06FEC042137CE3DA40103B99DA7E105601B27D7D282567A662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader neptunerat loader persistence trojan

Malware Config

Extracted

Family

neptunerat

ubel4mwwyv.localto.net:3162

Attributes

filename
USB.exe
group
MasonGroup
key
AS4863Qa6snBOlCi
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral2/memory/5584-1-0x0000000001250000-0x0000000001263000-memory.dmp	family_donutloader
behavioral2/memory/3868-8-0x0000000000C20000-0x0000000000C30000-memory.dmp	family_donutloader
behavioral2/memory/5584-13-0x000000001B7A0000-0x000000001B7B0000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/5584-4-0x00000000012A0000-0x00000000012B0000-memory.dmp	family_neptunerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	MasonClient.exe

Executes dropped EXE 11 IoCs

pid	Process
3868	MasonClient.exe
4132	MasonClient.exe
5432	MasonClient.exe
3260	MasonClient.exe
5788	MasonClient.exe
1976	MasonClient.exe
220	MasonClient.exe
2812	MasonClient.exe
5956	MasonClient.exe
3188	MasonClient.exe
5228	MasonClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MasonClient.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5584	MasonClient.exe
Token: SeDebugPrivilege	3868	MasonClient.exe
Token: SeDebugPrivilege	4132	MasonClient.exe
Token: SeDebugPrivilege	5432	MasonClient.exe
Token: SeDebugPrivilege	3260	MasonClient.exe
Token: SeDebugPrivilege	5788	MasonClient.exe
Token: SeDebugPrivilege	1976	MasonClient.exe
Token: SeDebugPrivilege	220	MasonClient.exe
Token: SeDebugPrivilege	2812	MasonClient.exe
Token: SeDebugPrivilege	5956	MasonClient.exe
Token: SeDebugPrivilege	3188	MasonClient.exe
Token: SeDebugPrivilege	5228	MasonClient.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 1800	5584	MasonClient.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1800

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
Size 654B
SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
MD5 11c6e74f0561678d2cf7fc075a6cc00c
SHA1 535ee79ba978554abcb98c566235805e7ea18490
SHA512 32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0
TLSH
T136F0783432A2E1D5C9127F111C1D298452AF8386B6A0AF1C7A68935DD8261376F313F3
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 78KB
SHA256 63e383ea42523763482bf51da4861f0c6fc8592717f365e6ab846f88529bb0b5
MD5 ecc44cfe267b57284b01014c1d4a2f47
SHA1 d23dd597f88a60845a8008825625a4142b74a9c2
SHA512 969ea3f59002a835ae0d81ec32488bc62f2558490298585f9c05f2fa0a1176e5757e9819fa00fdcc38152477223e2dad0d12a3e7876b713954936d22d5a1f241
SSDEEP 1536:DAKcF0+RDfGFVUfO2ZPXG+6AoMwwjEhqMvbrVTF3xGFSqgZYytSXRxzBrD:1MjxfcUnlXXr1j0fpF3UrgZYytARxN
TLSH
T15E73D09F9BF68B6DE1CF06FEC042137CE3DA40103B99DA7E105601B27D7D282567A662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3868-8-0x0000000000C20000-0x0000000000C30000-memory.dmp

Download

memory/3868-9-0x0000000000C20000-0x0000000000C30000-memory.dmp

Download

memory/5584-0-0x00000000009A0000-0x00000000009BA000-memory.dmp

Download

memory/5584-1-0x0000000001250000-0x0000000001263000-memory.dmp

Download

memory/5584-3-0x000000001B7A0000-0x000000001B7B0000-memory.dmp

Download

memory/5584-4-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/5584-12-0x000000001B7A0000-0x000000001B7B0000-memory.dmp

Download

memory/5584-13-0x000000001B7A0000-0x000000001B7B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads