Analysis
- max time kernel
39s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 20:00
Errors
General
- Target ThirdClient.exe
- Size 70KB
- Sample260802-yrgmpafa84
- SHA256 d9e1fce827cdd68b0aa7db4366b48a4a62db42f8fcfed35ee29a483e74874229
Malware Config
Extracted
-
asyncrat
-
ThirdReichRAT
-
ThirdRAT
-
82.22.62.95:6606
-
lmDtKqXWKOni
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Async RAT payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"C:\Users\Admin\AppData\Local\Temp\ThirdClient.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lpsxmv.exe"' & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lpsxmv.exe"'3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\lpsxmv.exe"C:\Users\Admin\AppData\Local\Temp\lpsxmv.exe"4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\byaokr.exe"' & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\byaokr.exe"'3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\byaokr.exe"C:\Users\Admin\AppData\Local\Temp\byaokr.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp44EA.tmp.bat""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000005081⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
byaokr.exe
lpsxmv.exe
tmp3E14.tmp
tmp44EA.tmp.bat
memory/1112-203-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1112-202-0x000001D658EC0000-0x000001D658EEB000-memory.dmp
memory/1172-122-0x0000018842860000-0x000001884288B000-memory.dmp
memory/1240-205-0x0000027D0DD50000-0x0000027D0DD7B000-memory.dmp
memory/1240-206-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1316-209-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1316-208-0x000001D14FFD0000-0x000001D14FFFB000-memory.dmp
memory/1328-212-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1328-211-0x000001817FEC0000-0x000001817FEEB000-memory.dmp
memory/1492-130-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1616-215-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1616-214-0x000001E1ED8D0000-0x000001E1ED8FB000-memory.dmp
memory/1632-218-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1632-217-0x0000022B9DED0000-0x0000022B9DEFB000-memory.dmp
memory/1656-221-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1656-220-0x00000236B2DC0000-0x00000236B2DEB000-memory.dmp
memory/1688-223-0x00000239D1F60000-0x00000239D1F8B000-memory.dmp
memory/1688-224-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1692-226-0x00000260A5A80000-0x00000260A5AAB000-memory.dmp
memory/1692-227-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1968-230-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/1968-229-0x00000214DE9F0000-0x00000214DEA1B000-memory.dmp
memory/2008-233-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2008-232-0x00000215C1BA0000-0x00000215C1BCB000-memory.dmp
memory/2080-237-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2080-235-0x000001D65FB40000-0x000001D65FB6B000-memory.dmp
memory/2088-236-0x000002BC49880000-0x000002BC498AB000-memory.dmp
memory/2088-239-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2116-241-0x00000242CE030000-0x00000242CE05B000-memory.dmp
memory/2116-242-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2264-244-0x0000023895E20000-0x0000023895E4B000-memory.dmp
memory/2264-245-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2308-247-0x00000214C9BB0000-0x00000214C9BDB000-memory.dmp
memory/2308-248-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2392-250-0x000001F768720000-0x000001F76874B000-memory.dmp
memory/2428-251-0x000001FDD4850000-0x000001FDD487B000-memory.dmp
memory/2428-252-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2468-255-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/2468-254-0x00000226B21E0000-0x00000226B220B000-memory.dmp
memory/2588-34-0x00000000005D0000-0x000000000064E000-memory.dmp
memory/2588-35-0x0000000002710000-0x0000000002766000-memory.dmp
memory/2824-23-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-19-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-22-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-36-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-24-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-18-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-21-0x000002BF64960000-0x000002BF64982000-memory.dmp
memory/2824-20-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-30-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-29-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-27-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2824-28-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3852-44-0x00000000007E0000-0x000000000086C000-memory.dmp
memory/3852-45-0x00000000010E0000-0x0000000001122000-memory.dmp
memory/4212-76-0x00007FFC959C0000-0x00007FFC95C23000-memory.dmp
memory/4212-77-0x00007FFC941E0000-0x00007FFC942A7000-memory.dmp
memory/4588-78-0x0000000000BD0000-0x0000000000BFA000-memory.dmp
memory/4588-80-0x00000000060C0000-0x0000000006152000-memory.dmp
memory/4812-197-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/4812-196-0x000001E0FC280000-0x000001E0FC2AB000-memory.dmp
memory/4932-2-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/4932-10-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4932-0-0x0000000000EF0000-0x0000000000F08000-memory.dmp
memory/4932-4-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4932-5-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5008-173-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/5792-6-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-14-0x0000000005D60000-0x0000000005D6E000-memory.dmp
memory/5792-7-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-16-0x0000000003220000-0x000000000322C000-memory.dmp
memory/5792-12-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-13-0x00000000088C0000-0x0000000008936000-memory.dmp
memory/5792-1-0x0000000000A60000-0x0000000000A71000-memory.dmp
memory/5792-15-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
memory/5792-3-0x0000000005D10000-0x0000000005D22000-memory.dmp
memory/5792-81-0x00000000031F0000-0x00000000031F1000-memory.dmp
memory/5792-11-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5792-187-0x00007FFC55B00000-0x00007FFC55B10000-memory.dmp
memory/5792-186-0x0000000006120000-0x000000000614B000-memory.dmp
memory/5824-72-0x0000000000BA0000-0x0000000000BB4000-memory.dmp