Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 12:01
General
- Target 2026-07-23_de753d4a6f68b265ce0a5a223b0fa4c4_akira_cobalt-strike_icedid_rusty-stealer_satacom_vidar.exe
- Size 5.6MB
- Sample260723-n7dwmaxgpb
- SHA256 ab7162730c30455d2a55033ab3d3804d2b82dee636e68a872cb94bdde0c94ffa
Malware Config
Extracted
-
asyncrat
-
0.0.1
-
Default
-
177.4.0.159:8848
-
global
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Detects executables containing the string DcRatBy 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 6 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_de753d4a6f68b265ce0a5a223b0fa4c4_akira_cobalt-strike_icedid_rusty-stealer_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_de753d4a6f68b265ce0a5a223b0fa4c4_akira_cobalt-strike_icedid_rusty-stealer_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\python\wefault.exe"C:\ProgramData\python\wefault.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\python\app-1.49.1\wefault.exe"C:\ProgramData\python\app-1.49.1\wefault.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
base32.pyc
VCRUNTIME140.dll
_ctypes.pyd
libffi-7.dll
python3.DLL
python310.dll
python310.zip
wefault.exe
wefault.exe
memory/2208-40-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-48-0x0000023CE5210000-0x0000023CE52C2000-memory.dmp
memory/2208-31-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-34-0x0000023CCCD10000-0x0000023CCCD32000-memory.dmp
memory/2208-35-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-36-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-37-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-38-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-39-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-29-0x00007FFBB1F5F000-0x00007FFBB1F60000-memory.dmp
memory/2208-41-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-42-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-47-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-30-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-46-0x0000023CE4F40000-0x0000023CE4F5E000-memory.dmp
memory/2208-49-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-43-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-50-0x0000023CE4F60000-0x0000023CE4F6A000-memory.dmp
memory/2208-53-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-52-0x0000023CE5520000-0x0000023CE5610000-memory.dmp
memory/2208-60-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/2208-57-0x00007FFBB1DD0000-0x00007FFBB2774000-memory.dmp
memory/4116-56-0x000002729FC70000-0x000002729FC86000-memory.dmp
memory/4116-26-0x000002729FAE0000-0x000002729FB0E000-memory.dmp
memory/4116-55-0x000002729FBE0000-0x000002729FBFB000-memory.dmp
memory/4116-61-0x00000272B9E10000-0x00000272B9F00000-memory.dmp
memory/4116-63-0x00000272B9E10000-0x00000272B9F00000-memory.dmp
memory/4116-64-0x00000272B9E10000-0x00000272B9F00000-memory.dmp