Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 21:35
General
- Target ThirdClient.exe
- Size 70KB
- Sample260717-1fc68sav8x
- SHA256 ab21687ee9c2480b9923cb93b1c3d7b507cd381dd6600da7400049c0abaf3642
Malware Config
Extracted
-
asyncrat
-
ThirdReichRAT
-
ThirdRAT
-
testhost221-51034.portmap.host:51034
-
iXh9Y8B4aEuC
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Async RAT payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3452-0-0x0000000000230000-0x0000000000248000-memory.dmp
memory/3452-2-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/3452-4-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-6-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-1-0x0000000000A60000-0x0000000000A71000-memory.dmp
memory/5792-3-0x0000000005C90000-0x0000000005CA2000-memory.dmp
memory/5792-5-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-7-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-8-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-9-0x00000000088C0000-0x0000000008936000-memory.dmp
memory/5792-10-0x0000000003200000-0x000000000320E000-memory.dmp
memory/5792-11-0x0000000006170000-0x000000000618E000-memory.dmp