Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 03:05
General
- Target 2026-08-08_983ef81fb2dd54ffda948d963365c1b5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 370KB
- Sample260808-dle7fsyflc
- SHA256 73346929f0e452c1877db613d4d1b51f58679485d6128a7ebcacb7095481faca
Malware Config
Extracted
-
asyncrat
-
Default
-
116.204.135.201:8848
-
DcRatMutex_qwqdanchun
-
delay
0
-
install
false
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_983ef81fb2dd54ffda948d963365c1b5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_983ef81fb2dd54ffda948d963365c1b5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4l3uesl8y6ha\loader.exe"C:\Users\Admin\AppData\Local\Temp\4l3uesl8y6ha\loader.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4l3uesl8y6ha\loader.exeC:\Users\Admin\AppData\Local\Temp\4l3uesl8y6ha\loader.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.jpg
loader.exe
memory/3032-18-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-19-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-13-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-14-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-15-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-17-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-11-0x00007FFA836AF000-0x00007FFA836B0000-memory.dmp
memory/3032-12-0x00000270F0260000-0x00000270F0276000-memory.dmp
memory/3032-20-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-21-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-23-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-24-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-27-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/3032-28-0x00000270F0420000-0x00000270F0496000-memory.dmp
memory/3032-29-0x00000270F0340000-0x00000270F0350000-memory.dmp
memory/3032-30-0x00000270F03A0000-0x00000270F03BE000-memory.dmp