Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 20:36
General
- Target x7fb0f8eee5b8a8a530dfddb4f95b8a09fac7a65f83987c1945d6c36f844c926a.exe
- Size 371KB
- Sample260702-zdr2yaev2z
- SHA256 7fb0f8eee5b8a8a530dfddb4f95b8a09fac7a65f83987c1945d6c36f844c926a
Malware Config
Extracted
-
asyncrat
-
Default
-
120.48.179.245:15948
-
CKC
-
delay
0
-
install
false
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x7fb0f8eee5b8a8a530dfddb4f95b8a09fac7a65f83987c1945d6c36f844c926a.exe"C:\Users\Admin\AppData\Local\Temp\x7fb0f8eee5b8a8a530dfddb4f95b8a09fac7a65f83987c1945d6c36f844c926a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wjpc0nebt2yq\loader.exe"C:\Users\Admin\AppData\Local\Temp\wjpc0nebt2yq\loader.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\wjpc0nebt2yq\loader.exeC:\Users\Admin\AppData\Local\Temp\wjpc0nebt2yq\loader.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.jpg
loader.exe
memory/3004-40-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-36-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-29-0x0000024B8F520000-0x0000024B8F536000-memory.dmp
memory/3004-39-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-38-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-37-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-42-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-41-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-35-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-34-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-33-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-32-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-31-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/3004-30-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-17-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-18-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-27-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-23-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-24-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-22-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-21-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-20-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-19-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-25-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-16-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-15-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-14-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-13-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-12-0x00000262F7C30000-0x00000262F7C46000-memory.dmp
memory/5700-11-0x00007FFA7705F000-0x00007FFA77060000-memory.dmp
memory/5700-43-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp
memory/5700-44-0x00007FFA76ED0000-0x00007FFA77874000-memory.dmp