Analysis
- max time kernel
254s - max time network
271s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
09/10/2026, 22:56
Errors
General
- Target 123.exe
- Size 154KB
- Sample261009-2ws33ads8m
- SHA256 f71459fba049998534698dee3b6d5512c3a0d065dd28aa07a7bac26d4963e598
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 61 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Checks computer location settings
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fab1e2fe637f45e5872ce24448168934.exe"C:\Users\Admin\AppData\Local\Temp\fab1e2fe637f45e5872ce24448168934.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2b54bb5222b24a3b98dec7502de16d09.exe"C:\Users\Admin\AppData\Local\Temp\2b54bb5222b24a3b98dec7502de16d09.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x2fc1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
2b54bb5222b24a3b98dec7502de16d09.exe
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
fab1e2fe637f45e5872ce24448168934.exe
memory/60-176-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/60-175-0x000002042B840000-0x000002042B86B000-memory.dmp
memory/236-84-0x0000000000510000-0x000000000053A000-memory.dmp
memory/408-178-0x0000022DCC4A0000-0x0000022DCC4CB000-memory.dmp
memory/408-179-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/612-96-0x0000024990F00000-0x0000024990F25000-memory.dmp
memory/612-97-0x0000024990F30000-0x0000024990F5B000-memory.dmp
memory/612-98-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/664-182-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/664-181-0x000002413D9B0000-0x000002413D9DB000-memory.dmp
memory/676-102-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/676-101-0x000001A6764C0000-0x000001A6764EB000-memory.dmp
memory/892-172-0x000001D2B5FF0000-0x000001D2B601B000-memory.dmp
memory/892-173-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/952-184-0x000002C050860000-0x000002C05088B000-memory.dmp
memory/952-185-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1076-187-0x00000194587D0000-0x00000194587FB000-memory.dmp
memory/1076-188-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1104-190-0x0000021AF9540000-0x0000021AF956B000-memory.dmp
memory/1104-191-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1148-113-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1148-112-0x00000238C44A0000-0x00000238C44CB000-memory.dmp
memory/1180-194-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1180-193-0x000001B0FC160000-0x000001B0FC18B000-memory.dmp
memory/1256-232-0x000001EEFB5A0000-0x000001EEFB5CB000-memory.dmp
memory/1256-233-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1284-239-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1284-238-0x0000027242BA0000-0x0000027242BCB000-memory.dmp
memory/1324-236-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1324-235-0x000002A28B490000-0x000002A28B4BB000-memory.dmp
memory/1340-40-0x0000000000C00000-0x0000000000C7E000-memory.dmp
memory/1340-41-0x0000000002D00000-0x0000000002D56000-memory.dmp
memory/1348-197-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1348-196-0x0000014F78EC0000-0x0000014F78EEB000-memory.dmp
memory/1456-241-0x000001CABDB60000-0x000001CABDB8B000-memory.dmp
memory/1456-242-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1468-199-0x0000023C427D0000-0x0000023C427FB000-memory.dmp
memory/1468-200-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1500-202-0x0000016288670000-0x000001628869B000-memory.dmp
memory/1500-203-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1524-205-0x00000233FD5D0000-0x00000233FD5FB000-memory.dmp
memory/1524-206-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1568-209-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1568-208-0x000001F45D7A0000-0x000001F45D7CB000-memory.dmp
memory/1672-211-0x000002114FB60000-0x000002114FB8B000-memory.dmp
memory/1672-213-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1708-212-0x0000018EF1DB0000-0x0000018EF1DDB000-memory.dmp
memory/1708-215-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1728-217-0x0000023CFB7B0000-0x0000023CFB7DB000-memory.dmp
memory/1728-218-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1752-221-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1752-220-0x000001743F500000-0x000001743F52B000-memory.dmp
memory/1836-223-0x0000023256B60000-0x0000023256B8B000-memory.dmp
memory/1836-224-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1932-227-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1932-226-0x000001CFAE3B0000-0x000001CFAE3DB000-memory.dmp
memory/1952-230-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/1952-229-0x000001C1BD630000-0x000001C1BD65B000-memory.dmp
memory/2156-244-0x000002B3EF8C0000-0x000002B3EF8EB000-memory.dmp
memory/2156-245-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/2244-248-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/2244-247-0x0000000001A40000-0x0000000001A6B000-memory.dmp
memory/2356-250-0x0000020030D70000-0x0000020030D9B000-memory.dmp
memory/2520-88-0x00007FFF3B850000-0x00007FFF3BA48000-memory.dmp
memory/2520-89-0x00007FFF3AAB0000-0x00007FFF3AB6D000-memory.dmp
memory/3500-25-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3500-20-0x00000000001B0000-0x000000000064C000-memory.dmp
memory/3500-24-0x00000000050A0000-0x00000000050AA000-memory.dmp
memory/3500-23-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3500-22-0x00000000050B0000-0x0000000005142000-memory.dmp
memory/3500-21-0x0000000005550000-0x0000000005AF6000-memory.dmp
memory/4072-170-0x00007FFEFB8D0000-0x00007FFEFB8E0000-memory.dmp
memory/4072-169-0x000001F977E50000-0x000001F977E7B000-memory.dmp
memory/4804-0-0x00000000016F0000-0x0000000001700000-memory.dmp
memory/4804-5-0x0000000075190000-0x0000000075741000-memory.dmp
memory/4804-4-0x0000000075190000-0x0000000075741000-memory.dmp
memory/4804-3-0x0000000075192000-0x0000000075194000-memory.dmp
memory/4804-2-0x00000000016F0000-0x0000000001700000-memory.dmp
memory/4804-1-0x0000000075192000-0x0000000075194000-memory.dmp
memory/5756-79-0x0000000000870000-0x0000000000884000-memory.dmp