Analysis
- max time kernel
148s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
10/11/2025, 09:48
General
- Target 61db9f343f29b3e55dfcbce369adc446c09129c4b468619775bf81e0a92680f0.exe
- Size 1.6MB
- Sample251110-lsv59avrdp
- SHA256 61db9f343f29b3e55dfcbce369adc446c09129c4b468619775bf81e0a92680f0
Malware Config
Extracted
-
asyncrat
-
LoaderPanel
-
Default
-
8fnuawbfuac.click:8888
-
8eh18dhq9wd.click:8888
-
8hdfiqowchq.click:8888
-
8nioqhxciwoqc.click:8888
-
8fhd2idhacas.click:8888
-
kuuumhncic
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Drops startup file 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61db9f343f29b3e55dfcbce369adc446c09129c4b468619775bf81e0a92680f0.exe"C:\Users\Admin\AppData\Local\Temp\61db9f343f29b3e55dfcbce369adc446c09129c4b468619775bf81e0a92680f0.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic" computersystem get domain2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aspnet_compiler.exe.log
memory/380-20233-0x0000000005910000-0x0000000005918000-memory.dmp
memory/380-10129-0x0000000000400000-0x00000000004BA000-memory.dmp
memory/380-10261-0x00000000055E0000-0x000000000577A000-memory.dmp
memory/1048-4565-0x0000000004B00000-0x0000000004C98000-memory.dmp
memory/1048-4536-0x0000000000400000-0x00000000004BA000-memory.dmp
memory/1048-16544-0x0000000004D30000-0x0000000004D38000-memory.dmp
memory/4672-9-0x0000000004F70000-0x0000000004FD6000-memory.dmp
memory/4672-13-0x0000000006D40000-0x00000000072E6000-memory.dmp
memory/4672-12-0x0000000005FE0000-0x0000000006072000-memory.dmp
memory/4672-11-0x0000000006260000-0x000000000678C000-memory.dmp
memory/4672-10-0x00000000051E0000-0x00000000051F0000-memory.dmp
memory/4672-8-0x0000000005290000-0x0000000005452000-memory.dmp
memory/4672-7-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5228-136-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-120-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-84-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-66-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-64-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-62-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-60-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-58-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-56-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-54-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-68-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-50-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-48-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-46-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-44-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-41-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-38-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-34-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-30-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-28-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-26-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-36-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-22-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-19-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-114-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-122-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-140-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-138-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-42-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-134-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-132-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-130-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-128-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-126-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-124-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-52-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-118-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-116-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-110-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-108-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-106-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-104-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-102-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-100-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-98-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-96-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-113-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-94-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-92-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-90-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-88-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-86-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-82-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-80-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-78-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-76-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-74-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-72-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-70-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-32-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-24-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-8487-0x0000000005170000-0x0000000005178000-memory.dmp
memory/5228-20-0x0000000005290000-0x0000000005424000-memory.dmp
memory/5228-18-0x0000000005A50000-0x0000000006068000-memory.dmp
memory/5228-17-0x0000000005290000-0x000000000542A000-memory.dmp
memory/5228-15-0x0000000000400000-0x00000000004BA000-memory.dmp
memory/5232-0-0x000001BEF7EC0000-0x000001BEF8054000-memory.dmp
memory/5232-1-0x000001BEFA600000-0x000001BEFA610000-memory.dmp
memory/5232-2-0x000001BEF84F0000-0x000001BEF84FA000-memory.dmp
memory/5232-6-0x000001BEFA600000-0x000001BEFA610000-memory.dmp