asyncrat | 35868f8861a5bd9342798cbff67ff80170d0957c2eeba7e35a8c352a4824a2f7

General

Target
2026-07-01_48fda20a0fbdfc3819b6a5e34ede2676_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260701-ly3saaa15l
SHA256 35868f8861a5bd9342798cbff67ff80170d0957c2eeba7e35a8c352a4824a2f7
MD5 48fda20a0fbdfc3819b6a5e34ede2676
SHA1 b440dd8ccd450b512be89d9afe36a7623ba991cd
SHA512 819d5452412916cc1d6a9b80d28c04504e0cd7cee76f115a4dd518b8b1da5adfbecd9842b6493ed6185ca4f502b5b0f361e3f17d263a17a2cd69f0bc5541d0e3
SSDEEP 24576:/mNVl6hvkJpJD1K/xo38L6P+aTnR+tLvOwOK0AY2KxM:0lUvQDAo34kR0Lm+0S
TLSH
T1EC456AE95DF447C4D511DA71B060C728B33AA160B9905BCE70AFFB613FA24E0EA74E61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

120.48.179.245:15948

Mutex

CKC

Attributes

delay
0
install
false

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/5564-27-0x0000017D94C60000-0x0000017D94C76000-memory.dmp	family_asyncrat
behavioral2/memory/5536-30-0x00000252BF300000-0x00000252BF316000-memory.dmp	family_asyncrat

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral2/memory/5564-27-0x0000017D94C60000-0x0000017D94C76000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral2/memory/5536-30-0x00000252BF300000-0x00000252BF316000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Executes dropped EXE 4 IoCs

pid	Process
1300	¿¨·þ¹¤¾ß.exe
5660	bundled.exe
5564	loader.exe
5536	loader.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvc7qjc4bjmj\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvc7qjc4bjmj\\loader.exe"	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¿¨·þ¹¤¾ß.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5564	loader.exe
5564	loader.exe
5564	loader.exe
5564	loader.exe
5564	loader.exe
5564	loader.exe
5564	loader.exe
5564	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe
5536	loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	loader.exe
Token: SeDebugPrivilege	5536	loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1300	¿¨·þ¹¤¾ß.exe
1300	¿¨·þ¹¤¾ß.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1300	4852	2026-07-01_48fda20a0fbdfc3819b6a5e34ede2676_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 4852 wrote to memory of 5660	4852	2026-07-01_48fda20a0fbdfc3819b6a5e34ede2676_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5660 wrote to memory of 5564	5660	bundled.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-01_48fda20a0fbdfc3819b6a5e34ede2676_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_48fda20a0fbdfc3819b6a5e34ede2676_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\¿¨·þ¹¤¾ß.exe
  "C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\¿¨·þ¹¤¾ß.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\bundled.exe
  "C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\bundled.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\loader.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5564

C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\loader.exe
C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\loader.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bundled.exe

Path C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\bundled.exe
Size 371KB
SHA256 7fb0f8eee5b8a8a530dfddb4f95b8a09fac7a65f83987c1945d6c36f844c926a
MD5 623ef2e852608d30ba3c52ce34b4a0b2
SHA1 81e7219baa654c22587279635f102fce51defb99
SHA512 c1b296bd0fec591ec968dd9413a5b7b68f7fe7fba3006b09687bdba25e83b19185c2b3316334aae3774230a29680dc2014c0e5a3e129584500a5b8390ac3fca3
SSDEEP 6144:kd5A+7O7tfbZblOkL/W6Naz4F/vjDbXCVwCt2bqVDhhiWiiW:kd5x7+fVblOaW6Naz4tnbiwCcb+OHiW
TLSH
T15684BEFAB94F29E5D9D59934A3B1930DDB31BC6002769E3F06D3B18D2E321424D1AB1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

¿¨·þ¹¤¾ß.exe

Path C:\Users\Admin\AppData\Local\Temp\Report0C98E5F508F54A29A23A0886648E24E9\¿¨·þ¹¤¾ß.exe
Size 676KB
SHA256 67f7e28d7bd129222c534f5bf46c81a61bd4e6dc0ccc2fa8c5e14f4d567d6597
MD5 f50082b82aa6863d584abf14ffed617f
SHA1 08457b539c7cf67aefcbf83b62d67c64cd892cce
SHA512 b0f2dd30b80414afe475ce5f5267cc09a29a98e4ace2915d072690e26c71494ada454434fcfcd537262fc9a5bdb08ae86276068ccc7fff4ff2bc45fe6992f916
SSDEEP 12288:tZKPlHCcFq+CbkkqneEZLojty4X/Ek0EjH:y9HHFLCblBg+t1X/Ek0eH
TLSH
T191E49E17B58380F6EA651832089AE737DA7B5A060F1DCFC39354FF5D1832161AE3A279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.jpg

Path C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\1.jpg
Size 99KB
SHA256 d9a2c1847dffab9d870ea8efb1e74e311735148e1aaf07dbc1cd1e734c018645
MD5 1fb3cd96c763b10b6184cf20e243a90d
SHA1 91db22042a626c72e7d08f610b76ac678398fcc3
SHA512 cdef14524ba30ab4cbc3601ec0094178fdc19e8b4aefd19d00fd9a168819d98a3b8ecf8b605174582a8aceb47fe1274455defb48993c2d9b0dde46bd52cfa7bd
SSDEEP 3072:gOJsWJO+ed0N6HcYss8pxk69k5d2Ghf4F5Bwg:JsoQcYsDkD/28f4F5z
TLSH
T152A313F38B340D6E22FCFF73C3C26E726A85926379CE96A6D3095604A651C919305E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\yvc7qjc4bjmj\loader.exe
Size 137KB
SHA256 713f45a50dfb9edbc520de1ad1e8762eb1c25ee85b7da086dd369643c6a40179
MD5 2c865fd14ea97acbdf058a50152cfab6
SHA1 07dae5c754623352ab4afbfb5cd493703801cbf0
SHA512 78e1fbe38b279f39d02a0764fc5f67d178fbf2d4b7267edd791c872ff7d1963342a9098e56da19f29faf58cc0efb807f2740589f5898c041cfa56c9f4436a48d
SSDEEP 3072:FZMnVNpRqTL4kFk4u/vUoR4qmQjYgOAtyuEMKt4wSP:sVk34kFQU4TmQby5MKt4w2
TLSH
T1DED37D5B77A530F9E4B78238C8A10646FB73B87247249B5F03A443A61F236919D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5536-30-0x00000252BF300000-0x00000252BF316000-memory.dmp

Download

memory/5564-27-0x0000017D94C60000-0x0000017D94C76000-memory.dmp

Download

memory/5564-31-0x0000017D96690000-0x0000017D966BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads