Analysis
- max time kernel
146s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 15:25
General
- Target MenuV2_Slayed.exe
- Size 839KB
- Sample261103-stsj3stsgy
- SHA256 25d96dd6a25f07675d0a5ba2af61ac46f0a3ca7c11fda286e7d4034421ba90e5
Malware Config
Extracted
-
xworm
-
5.0
-
31.6.50.53:1312
-
EzjxUxcAFLFDbirC
Extracted
-
neptunerat
-
31.6.50.53:1111
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
TzRydl2ZoiQlRyjA
-
rat_name
MasonRAT
Extracted
-
xworm
-
XWorm V5.6
-
foranother1337.publicvm.com:55554
-
Install_directory
%ProgramData%
-
install_file
chrome.exe
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 4 IoCs
- Detects NeptuneRAT stealer 2 IoCs
- Executes dropped EXE 5 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MenuV2_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\MenuV2_Slayed.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exe"C:\Users\Admin\AppData\Roaming\MasonClient.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\MenuV2.exe"C:\Users\Admin\AppData\Roaming\MenuV2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe"C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QhdflOwFXeGp.exe
chrome.exe
MasonClient.exe
MenuV2.exe
XClient.exe
memory/1744-63-0x00000000000B0000-0x00000000000E2000-memory.dmp
memory/2992-18-0x0000000000300000-0x000000000030E000-memory.dmp
memory/2992-48-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2992-30-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2992-65-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4116-34-0x0000000000760000-0x0000000000822000-memory.dmp
memory/4140-19-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-28-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-5-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-35-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-3-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-0-0x00007FF9B2B8F000-0x00007FF9B2B90000-memory.dmp
memory/4140-2-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4140-1-0x0000000000E20000-0x0000000000EF8000-memory.dmp
memory/4980-37-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-41-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-42-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-43-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-44-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-45-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-46-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-40-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-39-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-38-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-36-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-29-0x0000000000700000-0x0000000000712000-memory.dmp
memory/4980-66-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-67-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-68-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/4980-69-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp