Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 22:18
General
- Target 250008_PHoto.vbs
- Size 1.0MB
- Sample260707-1791aae121
- SHA256 f9c756ca8ac1121652029bd3f1430db2052b4aab2ffc355245827da94315d27b
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
1
-
acacww422542525.1cooldns.com:6060
-
dqqdqd
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\250008_PHoto.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:foetometry"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-12-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-10-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-4-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-5-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-6-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-7-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-8-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-15-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-13-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-11-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-3-0x000001E5EC180000-0x000001E5EC1A2000-memory.dmp
memory/424-0-0x00007FFB44EBF000-0x00007FFB44EC0000-memory.dmp
memory/424-9-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-16-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/424-17-0x000001E5EC690000-0x000001E5EC744000-memory.dmp
memory/424-18-0x000001E5EC220000-0x000001E5EC22A000-memory.dmp
memory/424-21-0x00007FFB44D30000-0x00007FFB456D4000-memory.dmp
memory/4820-19-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4820-22-0x0000000074362000-0x0000000074363000-memory.dmp
memory/4820-23-0x0000000005690000-0x000000000572C000-memory.dmp
memory/4820-24-0x0000000005CF0000-0x00000000062AA000-memory.dmp
memory/4820-25-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/4820-26-0x0000000074362000-0x0000000074363000-memory.dmp