Extracted

• • Target
    MasonClient_protected.exe
  • Size 234KB
  • SHA256 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71
  • MD5 870b0b55bf20894fd900663b3ada0680
  • SHA1 232877d12f76773ef1b4ac5f10d4262af158a38c
  • SHA512 5a4ab0080a82c85f895d07d3504e8be7fd86bc30809e1540b5b272389944d4de9ef083cff1a0f23d4940924080f9a64462470020446688b78c7e701ea5dff904
  • SSDEEP 6144:+/qK2eAFngHBY/263FPScKX1Y9jy7aQtyNU7jvQb:+/4rxgg2OOwuaI3
  • TLSH
    T13E349C244A912521C28D82FF74270B15E7F8CA7E7323D35AEE2A06F3F9D16E74E91550
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistenceprivilege_escalationtrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2behavioral3behavioral4