Analysis
- max time kernel
298s - max time network
297s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 03:50
General
- Target Request for Quotationq.vbs
- Size 156KB
- Sample260629-eefp3sdx5m
- SHA256 11ba24ad254c853ac33d8f3ab1b01f7d5657b5cfc65e55d7dc9c7a62da5ab868
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
216.250.250.247:4521
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotationq.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\26682A7F.ps1"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q45mg11b\q45mg11b.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F54.tmp" "c:\Users\Admin\AppData\Local\Temp\q45mg11b\CSCAAF6F8C3B4624CFCAC239C5BAF4E9385.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\1CF661FF.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1CF661FF.xml
26682A7F.ps1
RES4F54.tmp
__PSScriptPolicyTest_b0v5sgng.r4s.ps1
q45mg11b.dll
CSCAAF6F8C3B4624CFCAC239C5BAF4E9385.TMP
q45mg11b.0.cs
q45mg11b.cmdline
memory/1168-46-0x0000000005F60000-0x0000000005FFC000-memory.dmp
memory/1168-36-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2272-7-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/2272-6-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/2272-19-0x00000000075E0000-0x0000000007C5A000-memory.dmp
memory/2272-20-0x00000000062D0000-0x00000000062EA000-memory.dmp
memory/2272-16-0x0000000005DB0000-0x0000000005DCE000-memory.dmp
memory/2272-15-0x0000000005740000-0x0000000005A94000-memory.dmp
memory/2272-1-0x0000000002940000-0x0000000002950000-memory.dmp
memory/2272-17-0x0000000005E40000-0x0000000005E8C000-memory.dmp
memory/2272-5-0x0000000004E70000-0x0000000004E92000-memory.dmp
memory/2272-35-0x0000000006380000-0x0000000006388000-memory.dmp
memory/2272-4-0x0000000005030000-0x0000000005658000-memory.dmp
memory/2272-37-0x0000000007070000-0x0000000007106000-memory.dmp
memory/2272-38-0x0000000007010000-0x0000000007032000-memory.dmp
memory/2272-39-0x0000000008210000-0x00000000087B4000-memory.dmp
memory/2272-3-0x0000000002940000-0x0000000002950000-memory.dmp
memory/2272-2-0x00000000023F0000-0x0000000002426000-memory.dmp