Analysis
- user interaction
yes - max time kernel
898s - max time network
898s - platform
windows10-2004_x64 - resource
win10v2004-20260513-ja - resource tags
- submitted
13/07/2026, 04:33
General
- Target RKM-20260713-1514.7z
- Size 270KB
- Sample260713-e6t2sady9y
- SHA256 54b18666cff2721220a2aab4aaaef419b3fc22aa263edbbc43d7b3164f562f7d
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
192.252.180.45:4449
-
jsatnrumqsvfenqdgep
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RKM-20260713-1514.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Tax_Notice_73774.exe"C:\Users\Admin\Desktop\Tax_Notice_73774.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
\??\E:\Tax_Notice_73774.exe"E:\Tax_Notice_73774.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
nvml.dll
DataLogs.conf
memory/1096-16-0x00007FFF18700000-0x00007FFF18741000-memory.dmp
memory/1096-21-0x00007FFF18700000-0x00007FFF18741000-memory.dmp
memory/2260-29-0x00007FFF192B0000-0x00007FFF192F1000-memory.dmp
memory/2260-25-0x00007FFF192B0000-0x00007FFF192F1000-memory.dmp
memory/2360-10-0x000000001AE00000-0x000000001AE10000-memory.dmp
memory/2360-3-0x00007FFF160F0000-0x00007FFF16131000-memory.dmp
memory/2360-19-0x000000001B220000-0x000000001B32E000-memory.dmp
memory/2360-9-0x00000000007D0000-0x00000000007E8000-memory.dmp
memory/2360-8-0x000000001AE00000-0x000000001AE10000-memory.dmp
memory/2360-26-0x000000001AE00000-0x000000001AE10000-memory.dmp
memory/2360-2-0x00000000004E0000-0x00000000004FC000-memory.dmp
memory/2360-31-0x000000001AE00000-0x000000001AE10000-memory.dmp
memory/2360-30-0x000000001AE00000-0x000000001AE10000-memory.dmp