Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 15:12
General
- Target Dialysepatienter.exe
- Size 218KB
- Sample260715-slbxcsat7x
- SHA256 26fc8807ce9a5e6dc534c237d84c2ac7491755532a2078878bc8fb1695fcb2eb
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
217.217.97.75:8787
-
U1hmcTZViRT7
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"2⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"C:\Users\Admin\AppData\Local\Temp\Dialysepatienter.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/2828-469-0x0000000000470000-0x0000000001756000-memory.dmp
memory/2828-471-0x0000000000470000-0x0000000000482000-memory.dmp
memory/2828-464-0x0000000001760000-0x00000000024CE000-memory.dmp
memory/2828-466-0x000000007771D000-0x000000007771E000-memory.dmp
memory/2828-465-0x000000007775F000-0x0000000077760000-memory.dmp
memory/2828-467-0x00000000777E5000-0x00000000777E6000-memory.dmp
memory/2828-468-0x0000000001760000-0x00000000024CE000-memory.dmp
memory/2828-470-0x00000000776B1000-0x00000000777DF000-memory.dmp
memory/2828-482-0x0000000036AA0000-0x0000000036AAA000-memory.dmp
memory/2828-481-0x0000000036B00000-0x0000000036B40000-memory.dmp
memory/2828-473-0x00000000777E5000-0x00000000777E6000-memory.dmp
memory/2828-474-0x0000000035820000-0x00000000358BC000-memory.dmp
memory/2828-475-0x00000000358C0000-0x0000000035E7A000-memory.dmp
memory/2828-476-0x0000000035EC0000-0x0000000035F26000-memory.dmp
memory/2828-478-0x0000000036970000-0x00000000369E6000-memory.dmp
memory/2828-479-0x00000000369F0000-0x0000000036A8C000-memory.dmp
memory/2828-480-0x0000000036930000-0x000000003694E000-memory.dmp
memory/4960-463-0x0000000074055000-0x0000000074056000-memory.dmp
memory/4960-462-0x0000000003590000-0x00000000042FE000-memory.dmp