Analysis
- max time kernel
58s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 19:55
General
- Target 030775f37c6396d890d8ed207aedb698ba48ce873d6ec27e376c6bd68de6eeeb.exe
- Size 61KB
- Sample260810-ynb8ssxaqa
- SHA256 030775f37c6396d890d8ed207aedb698ba48ce873d6ec27e376c6bd68de6eeeb
Malware Config
Extracted
-
asyncrat
-
AWS | 3Losh
-
FRESH 17
-
ronaldbeck.duckdns.org:6606
-
beckronald.duckdns.org:6606
-
AsyncMutex_alosh
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
Network activity triggered a Suricata alert
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\030775f37c6396d890d8ed207aedb698ba48ce873d6ec27e376c6bd68de6eeeb.exe"C:\Users\Admin\AppData\Local\Temp\030775f37c6396d890d8ed207aedb698ba48ce873d6ec27e376c6bd68de6eeeb.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3872-0-0x0000000074A42000-0x0000000074A43000-memory.dmp
memory/3872-1-0x0000000000790000-0x00000000007A6000-memory.dmp
memory/3872-2-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/3872-3-0x0000000005A50000-0x000000000600A000-memory.dmp
memory/3872-4-0x0000000005680000-0x0000000005712000-memory.dmp
memory/3872-5-0x0000000005660000-0x000000000566A000-memory.dmp
memory/3872-8-0x0000000006D10000-0x0000000006DAC000-memory.dmp
memory/3872-9-0x0000000007260000-0x00000000072C6000-memory.dmp
memory/3872-10-0x0000000074A42000-0x0000000074A43000-memory.dmp
memory/3872-11-0x0000000074A30000-0x00000000751EC000-memory.dmp