Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
17/10/2025, 12:59
General
- Target RankupServicefreecheatV5.exe
- Size 1.9MB
- Sample251017-p8fx2sskt6
- SHA256 7d762632cff476032847ec9e7eaaa403009624e1c1ec87cb92371e84df25945d
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
up
-
157.97.11.134:8080
-
DcRtMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
tmp7C70..exe
-
install_folder
%Temp%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Async RAT payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RankupServicefreecheatV5.exe"C:\Users\Admin\AppData\Local\Temp\RankupServicefreecheatV5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
memory/752-40-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/752-39-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-5-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-4-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-3-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-6-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-9-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-11-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-10-0x00000000030E0000-0x00000000030F2000-memory.dmp
memory/752-8-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-7-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-12-0x000000001E8E0000-0x000000001EAFC000-memory.dmp
memory/752-13-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-14-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-15-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-1-0x00007FFEC2A84000-0x00007FFEC2A85000-memory.dmp
memory/752-2-0x0000000000400000-0x0000000000502000-memory.dmp
memory/752-50-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-31-0x0000000028080000-0x00000000280BC000-memory.dmp
memory/752-32-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/752-33-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-34-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-35-0x00007FFEC29E0000-0x00007FFEC2BE9000-memory.dmp
memory/752-37-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-38-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/752-29-0x000000001EBA0000-0x000000001EBC2000-memory.dmp
memory/752-0-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/752-41-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-42-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/752-43-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-45-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-47-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-49-0x0000000003EC0000-0x0000000004982000-memory.dmp
memory/752-48-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/5092-30-0x0000000000A60000-0x0000000000A76000-memory.dmp