Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 15:24
General
- Target BlandClient.exe
- Size 70KB
- Sample260620-ss3nnafx3r
- SHA256 f84be6f5f1ffecaaf67da611c60e3c954c913d1585dd382c9819d2a2f5ff370d
Malware Config
Extracted
-
asyncrat
-
V2.6
-
BlandRAT
-
promole66.ddns.net:4444
-
oe45g2VJQHtS
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Async RAT payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BlandClient.exe"C:\Users\Admin\AppData\Local\Temp\BlandClient.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3276-1-0x00007FFF3661F000-0x00007FFF36620000-memory.dmp
memory/3276-0-0x0000000000070000-0x0000000000088000-memory.dmp
memory/3276-4-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp
memory/3276-6-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp
memory/3620-2-0x0000000001570000-0x0000000001581000-memory.dmp
memory/3620-3-0x0000000007240000-0x0000000007252000-memory.dmp
memory/3620-5-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp
memory/3620-7-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp