Analysis
- user interaction
yes - max time kernel
9s - max time network
10s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 06:49
Errors
General
- Target Magellan.exe
- Size 167KB
- Sample261002-hlem5sty9p
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Malware Config
Signatures
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Magellan.exe"C:\Users\Admin\AppData\Local\Temp\Magellan.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D81⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR.exe
MasonRootkit.exe
memory/748-39-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/960-46-0x00000298D8EA0000-0x00000298D8ECB000-memory.dmp
memory/960-47-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/964-44-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/1156-54-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/1284-70-0x0000017D7EB20000-0x0000017D7EB4B000-memory.dmp
memory/1504-76-0x000001F119FD0000-0x000001F119FFB000-memory.dmp
memory/1504-77-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/1752-91-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/1764-144-0x00007FFF69BA0000-0x00007FFF69BB0000-memory.dmp
memory/3348-33-0x00007FFFA7E10000-0x00007FFFA7ED7000-memory.dmp
memory/3348-32-0x00007FFFA9A60000-0x00007FFFA9CC3000-memory.dmp
memory/6008-21-0x00000000744D0000-0x0000000074C8C000-memory.dmp
memory/6008-18-0x0000000000590000-0x0000000000598000-memory.dmp
memory/6008-17-0x00000000744E2000-0x00000000744E3000-memory.dmp
memory/6036-3-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/6036-0-0x00007FFF86A4F000-0x00007FFF86A50000-memory.dmp
memory/6036-1-0x0000000000250000-0x0000000000280000-memory.dmp
memory/6036-36-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/6036-2-0x0000000002390000-0x00000000023B6000-memory.dmp
memory/6036-7-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/6036-4-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp