Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 10:57
General
- Target 4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe
- Size 175KB
- Sample260824-m2sbdswfrd
- SHA256 4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486
Malware Config
Extracted
-
asyncrat
-
Default
-
https://api.telegram.org/bot7044437613:AAEXeS1SKGTrEjQ8F-7vSegWo8OLABeJY5k/sendMessage?chat_id=6052812018
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 4 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe"C:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exeC:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
History.txt
Bookmarks.txt
Desktop.txt
Documents.txt
Downloads.txt
OneDrive.txt
Pictures.txt
Startup.txt
Temp.txt
Videos.txt
Desktop.jpg
Process.txt
Process.txt
Process.txt
ProductKey.txt
ScanningNetworks.txt
msgid.dat
memory/5752-68-0x0000000074782000-0x0000000074783000-memory.dmp
memory/5752-83-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5752-114-0x00000000066B0000-0x00000000066BA000-memory.dmp
memory/5752-121-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5752-0-0x0000000074782000-0x0000000074783000-memory.dmp
memory/5752-110-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5752-5-0x00000000061E0000-0x0000000006272000-memory.dmp
memory/5752-4-0x00000000066C0000-0x0000000006C7A000-memory.dmp
memory/5752-3-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5752-2-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/5752-1-0x0000000000E60000-0x0000000000E92000-memory.dmp
memory/5752-120-0x00000000079C0000-0x00000000079CA000-memory.dmp