Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/08/2026, 22:16
General
- Target 5334ab4eafeb63eaeab2d69bdfedf38cb92ed5d88dfe96564171cdfa22e3da17.exe
- Size 813KB
- Sample260830-161p8aap4s
- SHA256 5334ab4eafeb63eaeab2d69bdfedf38cb92ed5d88dfe96564171cdfa22e3da17
Malware Config
Extracted
-
asyncrat
-
Default
-
43.226.47.184:8848
-
435423543643626
-
delay
0
-
install
false
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5334ab4eafeb63eaeab2d69bdfedf38cb92ed5d88dfe96564171cdfa22e3da17.exe"C:\Users\Admin\AppData\Local\Temp\5334ab4eafeb63eaeab2d69bdfedf38cb92ed5d88dfe96564171cdfa22e3da17.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1\loader64.exe"C:\Users\Admin\AppData\Local\Temp\1\loader64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
loader64.exe
memory/4656-11-0x00007FF88E35F000-0x00007FF88E360000-memory.dmp
memory/4656-12-0x00000165DA660000-0x00000165DA676000-memory.dmp
memory/4656-13-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-14-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-15-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-16-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-17-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-18-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-19-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-20-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-21-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-22-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-23-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-24-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-25-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-26-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-27-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/4656-28-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp