Analysis
- max time kernel
246s - max time network
262s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
09/10/2026, 22:56
Errors
General
- Target 123.exe
- Size 154KB
- Sample261009-2wva5ads8p
- SHA256 f71459fba049998534698dee3b6d5512c3a0d065dd28aa07a7bac26d4963e598
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 61 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5a0f3888c8bf420abe62a2021e214f01.exe"C:\Users\Admin\AppData\Local\Temp\5a0f3888c8bf420abe62a2021e214f01.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\39a770f609ed4c869b9f773f21c1b117.exe"C:\Users\Admin\AppData\Local\Temp\39a770f609ed4c869b9f773f21c1b117.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
39a770f609ed4c869b9f773f21c1b117.exe
5a0f3888c8bf420abe62a2021e214f01.exe
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/412-97-0x0000028796260000-0x000002879628B000-memory.dmp
memory/412-98-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/428-92-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/428-91-0x000001B621000000-0x000001B62102B000-memory.dmp
memory/652-82-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/652-80-0x000001B7DE000000-0x000001B7DE025000-memory.dmp
memory/652-81-0x000001B7DE030000-0x000001B7DE05B000-memory.dmp
memory/708-85-0x000002393F9C0000-0x000002393F9EB000-memory.dmp
memory/708-86-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/768-33-0x00000000007C0000-0x000000000083E000-memory.dmp
memory/768-34-0x0000000002820000-0x0000000002876000-memory.dmp
memory/904-94-0x000002965C360000-0x000002965C38B000-memory.dmp
memory/904-95-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1112-104-0x0000022BCFD30000-0x0000022BCFD5B000-memory.dmp
memory/1112-105-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1172-108-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1172-107-0x000001F8F3CF0000-0x000001F8F3D1B000-memory.dmp
memory/1192-110-0x0000017859350000-0x000001785937B000-memory.dmp
memory/1192-111-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1248-113-0x0000021A6B340000-0x0000021A6B36B000-memory.dmp
memory/1248-114-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1256-120-0x000001AB8C560000-0x000001AB8C58B000-memory.dmp
memory/1256-121-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1344-123-0x0000014B95100000-0x0000014B9512B000-memory.dmp
memory/1344-124-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1368-126-0x0000017CED510000-0x0000017CED53B000-memory.dmp
memory/1368-127-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1416-130-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1416-129-0x000001D10AD50000-0x000001D10AD7B000-memory.dmp
memory/1444-138-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1444-137-0x0000020300760000-0x000002030078B000-memory.dmp
memory/1524-141-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1524-140-0x0000029ACE090000-0x0000029ACE0BB000-memory.dmp
memory/1568-0-0x0000000074871000-0x0000000074872000-memory.dmp
memory/1568-3-0x0000000074870000-0x0000000074E21000-memory.dmp
memory/1568-4-0x0000000074870000-0x0000000074E21000-memory.dmp
memory/1568-2-0x0000000074870000-0x0000000074E21000-memory.dmp
memory/1568-1-0x0000000074870000-0x0000000074E21000-memory.dmp
memory/1704-171-0x000002C0D2A60000-0x000002C0D2A8B000-memory.dmp
memory/1704-172-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1728-144-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1728-143-0x0000021FF6630000-0x0000021FF665B000-memory.dmp
memory/1800-146-0x00000217C1540000-0x00000217C156B000-memory.dmp
memory/1800-147-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1808-149-0x0000019AFBB90000-0x0000019AFBBBB000-memory.dmp
memory/1808-150-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1856-155-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1856-154-0x000002615CCD0000-0x000002615CCFB000-memory.dmp
memory/1892-158-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1892-157-0x000001E5B9D40000-0x000001E5B9D6B000-memory.dmp
memory/1940-162-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/1940-161-0x000001A9D26C0000-0x000001A9D26EB000-memory.dmp
memory/2012-169-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2012-168-0x0000024AA6B90000-0x0000024AA6BBB000-memory.dmp
memory/2044-21-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/2044-20-0x00000000058B0000-0x00000000058BA000-memory.dmp
memory/2044-19-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/2044-18-0x0000000005800000-0x0000000005892000-memory.dmp
memory/2044-17-0x0000000005DB0000-0x0000000006356000-memory.dmp
memory/2044-16-0x00000000009D0000-0x0000000000E6C000-memory.dmp
memory/2080-175-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2080-174-0x000001B37F490000-0x000001B37F4BB000-memory.dmp
memory/2092-177-0x00000223FD150000-0x00000223FD17B000-memory.dmp
memory/2092-178-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2196-182-0x00000246F69D0000-0x00000246F69FB000-memory.dmp
memory/2196-183-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2204-58-0x0000000000180000-0x0000000000194000-memory.dmp
memory/2228-186-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2228-185-0x000001ED6C830000-0x000001ED6C85B000-memory.dmp
memory/2260-69-0x00000000007C0000-0x00000000007EA000-memory.dmp
memory/2292-190-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2292-189-0x0000000000AE0000-0x0000000000B0B000-memory.dmp
memory/2368-194-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2368-193-0x0000019AD5570000-0x0000019AD559B000-memory.dmp
memory/2576-198-0x00007FFB89A30000-0x00007FFB89A40000-memory.dmp
memory/2576-197-0x00000151AC460000-0x00000151AC48B000-memory.dmp
memory/2640-206-0x000001AC16710000-0x000001AC1673B000-memory.dmp
memory/5072-74-0x00007FFBC7F70000-0x00007FFBC802D000-memory.dmp
memory/5072-73-0x00007FFBC99A0000-0x00007FFBC9BA9000-memory.dmp