Analysis
- max time kernel
2s - max time network
5s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 00:57
Errors
General
- Target Releases/Magellan.exe
- Size 167KB
- Sample261030-bbfdcsvsg1
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Malware Config
Signatures
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Releases\Magellan.exe"C:\Users\Admin\AppData\Local\Temp\Releases\Magellan.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Releases\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\Releases\MasonGDI.exe"2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Releases\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Releases\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\Releases\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C81⤵
-
C:\Users\Admin\AppData\Local\Temp\Releases\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\Releases\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR.exe
MasonRootkit.exe
memory/744-40-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/744-38-0x000001E3B2D90000-0x000001E3B2DB5000-memory.dmp
memory/744-39-0x000001E3B2DC0000-0x000001E3B2DEB000-memory.dmp
memory/852-133-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/852-132-0x00000200D6FC0000-0x00000200D6FEB000-memory.dmp
memory/960-46-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/960-45-0x0000027B2CA70000-0x0000027B2CA9B000-memory.dmp
memory/968-44-0x00000228C7A30000-0x00000228C7A5B000-memory.dmp
memory/968-48-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/996-129-0x0000027B82280000-0x0000027B822AB000-memory.dmp
memory/996-130-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1120-135-0x000001D9A70B0000-0x000001D9A70DB000-memory.dmp
memory/1120-136-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1172-55-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1172-54-0x0000025D85C70000-0x0000025D85C9B000-memory.dmp
memory/1256-138-0x0000022951F10000-0x0000022951F3B000-memory.dmp
memory/1256-139-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1312-109-0x0000022A114E0000-0x0000022A1150B000-memory.dmp
memory/1312-110-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1316-141-0x00000216F4F90000-0x00000216F4FBB000-memory.dmp
memory/1316-142-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1348-169-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1348-168-0x0000016B28A40000-0x0000016B28A6B000-memory.dmp
memory/1356-144-0x0000015877DA0000-0x0000015877DCB000-memory.dmp
memory/1356-145-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1384-147-0x00000279DEE00000-0x00000279DEE2B000-memory.dmp
memory/1384-148-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1548-68-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1548-66-0x000001A1D0710000-0x000001A1D073B000-memory.dmp
memory/1612-151-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1612-150-0x000001D86A920000-0x000001D86A94B000-memory.dmp
memory/1628-153-0x00000294E9D80000-0x00000294E9DAB000-memory.dmp
memory/1628-154-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1700-156-0x000002135EE50000-0x000002135EE7B000-memory.dmp
memory/1700-157-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1712-159-0x000001ADA0C40000-0x000001ADA0C6B000-memory.dmp
memory/1712-160-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1724-163-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1724-162-0x00000244EE760000-0x00000244EE78B000-memory.dmp
memory/1932-166-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/1932-165-0x000001EB52DB0000-0x000001EB52DDB000-memory.dmp
memory/2068-171-0x000001C398030000-0x000001C39805B000-memory.dmp
memory/2068-172-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2096-174-0x000002BEDEB10000-0x000002BEDEB3B000-memory.dmp
memory/2096-175-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2108-178-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2108-177-0x0000023DE3DD0000-0x0000023DE3DFB000-memory.dmp
memory/2208-180-0x00000272B8D30000-0x00000272B8D5B000-memory.dmp
memory/2208-181-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2312-186-0x000001F9C0190000-0x000001F9C01BB000-memory.dmp
memory/2312-187-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2324-183-0x000001D9608C0000-0x000001D9608EB000-memory.dmp
memory/2324-184-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2428-19-0x0000000000550000-0x0000000000558000-memory.dmp
memory/2428-20-0x0000000074C62000-0x0000000074C63000-memory.dmp
memory/2428-21-0x0000000074C50000-0x000000007540C000-memory.dmp
memory/2464-189-0x0000020D13450000-0x0000020D1347B000-memory.dmp
memory/2464-190-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2488-192-0x0000020D01DE0000-0x0000020D01E0B000-memory.dmp
memory/2488-193-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2580-195-0x0000011E57FD0000-0x0000011E57FFB000-memory.dmp
memory/2848-127-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp
memory/2848-125-0x000001B7E1EC0000-0x000001B7E1EEB000-memory.dmp
memory/3128-37-0x00007FFE8BDB0000-0x00007FFE8BE77000-memory.dmp
memory/3128-36-0x00007FFE8D1A0000-0x00007FFE8D403000-memory.dmp
memory/4072-9-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-304-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-0-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp
memory/4072-6-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-5-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-4-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-3-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4072-2-0x0000000002C30000-0x0000000002C56000-memory.dmp
memory/4072-1-0x0000000000BC0000-0x0000000000BF0000-memory.dmp
memory/4624-121-0x0000000003A50000-0x0000000003A7B000-memory.dmp
memory/4624-122-0x00007FFE4D2E0000-0x00007FFE4D2F0000-memory.dmp