Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/02/2026, 19:25
General
- Target ca642c042b5443af22a42afab35b4c24faf7b9b51b051.exe
- Size 67KB
- Sample260220-x45plsax2f
- SHA256 ca642c042b5443af22a42afab35b4c24faf7b9b51b05110ed32942b7990500a3
Malware Config
Extracted
-
asyncrat
-
0.5.9 A
-
SMART WHITE
-
nano.viewdns.net:7232
-
194.116.236.112:7232
-
AZsGlRhfyj4m
-
delay
5
-
install
false
-
install_file
null
-
install_folder
null
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca642c042b5443af22a42afab35b4c24faf7b9b51b051.exe"C:\Users\Admin\AppData\Local\Temp\ca642c042b5443af22a42afab35b4c24faf7b9b51b051.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4408-0-0x0000000000930000-0x0000000000948000-memory.dmp
memory/4408-1-0x0000000005580000-0x0000000005590000-memory.dmp
memory/4408-4-0x0000000005970000-0x0000000005A0C000-memory.dmp
memory/4408-5-0x00000000066E0000-0x0000000006C86000-memory.dmp
memory/4408-6-0x00000000061A0000-0x0000000006206000-memory.dmp
memory/4408-7-0x00000000070B0000-0x0000000007126000-memory.dmp
memory/4408-8-0x0000000007030000-0x0000000007082000-memory.dmp
memory/4408-9-0x0000000007150000-0x000000000716E000-memory.dmp
memory/4408-10-0x0000000007180000-0x000000000718A000-memory.dmp
memory/4408-11-0x0000000005310000-0x00000000053D1000-memory.dmp
memory/4408-12-0x0000000005580000-0x0000000005590000-memory.dmp