Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 25596e7b6ad36b42fc82b25876b7100f60dedbc219e66e5457a00fb8a96b1bf8
  • MD5 fde6f98508652782b51f7c2df42c9129
  • SHA1 02f9cdb9f03cd587062ede35a7268cc614bf2b0e
  • SHA512 1cb553ff2476f02f671fc77a536f234aa8e20ecd639f07b2ba67f999645fd46c9c77354aef71f385fa03691ceb4ccb5fe50d5a6e258544be3d6b16b4cf530030
  • SSDEEP 1536:kwvh/MqlPteG64sDsfqCIwhNySvhvQ9Salb5U8tmoIbO+k:k8h/MO1eG64sDsfqCIwhNyOhvQ97b5UK
  • TLSH
    T16A23C69CA7D94131E0BE56B21DB7424893B4BE938466D79F7CC401CA2B27B89C641EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryneptunerattrojanbootkitpersistenceexecutionprivilege_escalation

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4