Analysis
- max time kernel
54s - max time network
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 22:32
Errors
General
- Target ThirdClient.exe
- Size 70KB
- Sample260718-2gam6shs3s
- SHA256 9b49975787794c779d5ff7c2c88a74ffd19445ee7eba0ba0449a5ac53eb3dcc4
Malware Config
Extracted
-
asyncrat
-
ThirdReichRAT
-
ThirdRAT
-
82.22.62.95:3413
-
jgnJxHJWLsrT
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Async RAT payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jojxhf.exe"' & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jojxhf.exe"'3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\jojxhf.exe"C:\Users\Admin\AppData\Local\Temp\jojxhf.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jojxhf.exe
memory/3380-14-0x00000000034A0000-0x00000000034BE000-memory.dmp
memory/3380-2-0x0000000000CE0000-0x0000000000CF1000-memory.dmp
memory/3380-3-0x00000000035E0000-0x00000000035F2000-memory.dmp
memory/3380-5-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/3380-15-0x0000000003480000-0x000000000348C000-memory.dmp
memory/3380-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/3380-10-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/3380-11-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/3380-12-0x0000000003780000-0x00000000037F6000-memory.dmp
memory/3380-13-0x0000000003470000-0x000000000347E000-memory.dmp
memory/3556-35-0x0000000000310000-0x0000000000318000-memory.dmp
memory/4220-17-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-26-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-34-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-18-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-19-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-20-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-21-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-24-0x0000021C2A610000-0x0000021C2A632000-memory.dmp
memory/4220-25-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-30-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-27-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-28-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4220-29-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-8-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-4-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-1-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp
memory/5904-0-0x0000000000910000-0x0000000000928000-memory.dmp