Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 20:15
General
- Target ITRIntimation24-25.vbs
- Size 4.3MB
- Sample260730-y12dfsfa29
- SHA256 b7330cf42457ba3a1cb515d260f2fb3f4dd90e4de9cf26fd6b070cf53109df6d
Malware Config
Extracted
-
asyncrat
-
AWS | 3Losh
-
MAJOR RED
-
64.89.163.114:6606
-
prakashjadhav7473.duckdns.org:6606
-
AsyncMutex_alosh
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ITRIntimation24-25.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$b64=[IO.File]::ReadAllText('C:\Temp\yellow.b64');$raw=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64));[IO.File]::WriteAllBytes('C:\Temp\yellow.bat',[Convert]::FromBase64String($raw));Remove-Item 'C:\Temp\yellow.b64'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Temp\yellow.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -exec bypass -F "C:\Temp\update.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v nrklnm /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe5⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5300 -ip 53001⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
yellow.b64
yellow.bat
StartupProfileData-NonInteractive
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/1388-48-0x0000000007E70000-0x0000000007E7A000-memory.dmp
memory/1388-44-0x00000000070C0000-0x00000000070D6000-memory.dmp
memory/1388-46-0x0000000008290000-0x000000000884A000-memory.dmp
memory/1388-47-0x0000000007EC0000-0x0000000007F52000-memory.dmp
memory/1388-49-0x00000000089A0000-0x0000000008A3C000-memory.dmp
memory/1388-50-0x0000000008A40000-0x0000000008AA6000-memory.dmp
memory/5300-42-0x0000000000A30000-0x0000000000A48000-memory.dmp
memory/5660-10-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-12-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-19-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-22-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-21-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-17-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-16-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-14-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-13-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-18-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-1-0x00007FFBCAD1F000-0x00007FFBCAD20000-memory.dmp
memory/5660-9-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-8-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-7-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-6-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5660-4-0x00000116A9B40000-0x00000116A9B62000-memory.dmp
memory/5660-5-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp