Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 09:05
General
- Target 8e91a0dff69dd24a7ce267f4364510167c35e3df01c37fe00db4eef25d1fcbd6.exe
- Size 496KB
- Sample260730-k2df5aeg35
- SHA256 8e91a0dff69dd24a7ce267f4364510167c35e3df01c37fe00db4eef25d1fcbd6
Malware Config
Extracted
-
asyncrat
-
AA
-
yoindje.shop:8848
-
yoindje.shop:12159
-
aa
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e91a0dff69dd24a7ce267f4364510167c35e3df01c37fe00db4eef25d1fcbd6.exe"C:\Users\Admin\AppData\Local\Temp\8e91a0dff69dd24a7ce267f4364510167c35e3df01c37fe00db4eef25d1fcbd6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\resources\psl.exe"C:\Users\Admin\resources\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\guardian.cmd' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'cmd.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wscript.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'cscript.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\pmrun\psl.exe"C:\pmrun\psl.exe" --background1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\pmrun' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\psl.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionPath 'C:\pmrun\guardian.cmd' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'cmd.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'wscript.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'cscript.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qer5nsru.amy.ps1
libpsl-5.dll
psl.exe
memory/2276-88-0x000001E487500000-0x000001E487514000-memory.dmp
memory/2276-55-0x00007FF6B80D0000-0x00007FF6B80E5000-memory.dmp
memory/2276-56-0x00007FFA4D1C0000-0x00007FFA4D1D6000-memory.dmp
memory/4340-51-0x00007FFA57EE0000-0x00007FFA57EF6000-memory.dmp
memory/4340-50-0x00007FF744FB0000-0x00007FF744FC5000-memory.dmp
memory/4340-48-0x00007FF744FB0000-0x00007FF744FC5000-memory.dmp
memory/4340-49-0x00007FFA57EE0000-0x00007FFA57EF6000-memory.dmp
memory/5996-23-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-38-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-28-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-29-0x000001DDBA410000-0x000001DDBA41A000-memory.dmp
memory/5996-30-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-31-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-32-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-33-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-34-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-35-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-37-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-27-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-26-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-22-0x000001DDBA3F0000-0x000001DDBA40E000-memory.dmp
memory/5996-25-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-24-0x000001DDBA6A0000-0x000001DDBA752000-memory.dmp
memory/5996-19-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-18-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-54-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-17-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp
memory/5996-16-0x000001DDBA390000-0x000001DDBA3B2000-memory.dmp
memory/5996-13-0x00007FFA442EF000-0x00007FFA442F0000-memory.dmp