Analysis
- max time kernel
2s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
04/11/2026, 18:06
Errors
General
- Target Squidward.exe
- Size 535KB
- Sample261104-wp5kmayv9j
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Squidward.exe"C:\Users\Admin\AppData\Local\Temp\Squidward.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5FD.tmp.bat""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-SLEEP.exe
MasonMBR.exe
MasonRootkit.exe
tmpB5FD.tmp.bat
memory/428-69-0x00000220FA4A0000-0x00000220FA4CB000-memory.dmp
memory/428-70-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/468-63-0x000001FA55090000-0x000001FA550BB000-memory.dmp
memory/468-64-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/644-52-0x0000019BEC2F0000-0x0000019BEC315000-memory.dmp
memory/644-54-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/644-53-0x0000019BEC320000-0x0000019BEC34B000-memory.dmp
memory/700-57-0x0000027838A60000-0x0000027838A8B000-memory.dmp
memory/700-58-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/728-28-0x00007FFFF4FA0000-0x00007FFFF51A9000-memory.dmp
memory/728-34-0x00007FFFF4110000-0x00007FFFF41CD000-memory.dmp
memory/908-66-0x0000021852760000-0x000002185278B000-memory.dmp
memory/908-67-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1036-191-0x0000017E0DEF0000-0x0000017E0DF1B000-memory.dmp
memory/1036-192-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1044-74-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1044-73-0x00000245997D0000-0x00000245997FB000-memory.dmp
memory/1100-86-0x000001E433C00000-0x000001E433C2B000-memory.dmp
memory/1100-87-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1224-92-0x0000029FEFD90000-0x0000029FEFDBB000-memory.dmp
memory/1224-93-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1232-79-0x00000214EDAB0000-0x00000214EDADB000-memory.dmp
memory/1232-80-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1240-96-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1240-95-0x0000024EF2C60000-0x0000024EF2C8B000-memory.dmp
memory/1252-99-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1252-98-0x00000185FC180000-0x00000185FC1AB000-memory.dmp
memory/1304-101-0x0000017159BC0000-0x0000017159BEB000-memory.dmp
memory/1304-102-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1328-90-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1328-89-0x000002AD65940000-0x000002AD6596B000-memory.dmp
memory/1420-113-0x0000021DFFA90000-0x0000021DFFABB000-memory.dmp
memory/1420-114-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1464-116-0x0000025784B80000-0x0000025784BAB000-memory.dmp
memory/1464-117-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1472-120-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1472-119-0x0000025DF43A0000-0x0000025DF43CB000-memory.dmp
memory/1500-186-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1500-185-0x000001B6DD120000-0x000001B6DD14B000-memory.dmp
memory/1764-122-0x000002035DFB0000-0x000002035DFDB000-memory.dmp
memory/1764-123-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1772-126-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1772-125-0x000001FFFC2D0000-0x000001FFFC2FB000-memory.dmp
memory/1804-129-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1804-128-0x0000015DB39B0000-0x0000015DB39DB000-memory.dmp
memory/1812-131-0x0000020671770000-0x000002067179B000-memory.dmp
memory/1812-132-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1900-135-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1900-134-0x000002DFFED40000-0x000002DFFED6B000-memory.dmp
memory/1988-138-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/1988-137-0x0000020B2C460000-0x0000020B2C48B000-memory.dmp
memory/2008-188-0x000001491B490000-0x000001491B4BB000-memory.dmp
memory/2008-189-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2120-194-0x00000177C4170000-0x00000177C419B000-memory.dmp
memory/2120-195-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2128-197-0x0000021BBCD90000-0x0000021BBCDBB000-memory.dmp
memory/2128-198-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2248-201-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2248-200-0x000002C3518F0000-0x000002C35191B000-memory.dmp
memory/2284-203-0x0000019398510000-0x000001939853B000-memory.dmp
memory/2284-204-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2360-206-0x00000000015A0000-0x00000000015CB000-memory.dmp
memory/2360-207-0x00007FFFB5030000-0x00007FFFB5040000-memory.dmp
memory/2472-209-0x00000274061B0000-0x00000274061DB000-memory.dmp
memory/3860-0-0x0000000000650000-0x00000000006DC000-memory.dmp
memory/3860-2-0x00000000026B0000-0x00000000026F2000-memory.dmp
memory/3860-1-0x000000001B3F0000-0x000000001B400000-memory.dmp
memory/4516-44-0x0000000004E30000-0x0000000004EC2000-memory.dmp
memory/4516-41-0x00000000000D0000-0x00000000000E6000-memory.dmp
memory/4808-38-0x0000000000EC0000-0x0000000000ED6000-memory.dmp