Analysis
- max time kernel
298s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/07/2026, 17:15
General
- Target Tax_Notice_92730.exe
- Size 287KB
- Sample260707-vstrvsat91
- SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
192.252.180.45:4449
-
jsatnrumqsvfenqdgep
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exe1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exeC:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exe1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exeC:\Users\Admin\AppData\Local\Temp\Tax_Notice_92730.exe1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tax_Notice_92730.exe.log
RuntimeBroker.exe
nvml.dll
DataLogs.conf
memory/1972-32-0x00007FFE78620000-0x00007FFE78661000-memory.dmp
memory/3928-21-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-25-0x00007FFE78620000-0x00007FFE78661000-memory.dmp
memory/3928-7-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-5-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-20-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-0-0x00000000007E0000-0x00000000007FC000-memory.dmp
memory/3928-22-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-23-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-24-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-8-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-26-0x000000001C000000-0x000000001C076000-memory.dmp
memory/3928-27-0x000000001BF80000-0x000000001BFE6000-memory.dmp
memory/3928-28-0x000000001AF70000-0x000000001AF8E000-memory.dmp
memory/3928-30-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/3928-6-0x00000000020D0000-0x00000000020E8000-memory.dmp
memory/3928-33-0x00000000020F0000-0x0000000002100000-memory.dmp
memory/4032-61-0x00007FFE78620000-0x00007FFE78661000-memory.dmp
memory/5068-17-0x00007FFE66B40000-0x00007FFE66B81000-memory.dmp