Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 15:24
General
- Target 13f867ba5f46eae93cf52215367a7136566f86274d77df49bb07057ff1358ec5.exe
- Size 77KB
- Sample260908-stg4catbla
- SHA256 13f867ba5f46eae93cf52215367a7136566f86274d77df49bb07057ff1358ec5
Malware Config
Extracted
-
asyncrat
-
| Edit by Vinom Rat
-
Default
-
107.172.134.37:5577
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13f867ba5f46eae93cf52215367a7136566f86274d77df49bb07057ff1358ec5.exe"C:\Users\Admin\AppData\Local\Temp\13f867ba5f46eae93cf52215367a7136566f86274d77df49bb07057ff1358ec5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath "C:""2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wwvvapas.t23.ps1
memory/3464-44-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/3464-43-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/3464-42-0x00000000014A0000-0x00000000014B6000-memory.dmp
memory/3464-0-0x0000000000AF0000-0x0000000000AFA000-memory.dmp
memory/4280-26-0x0000000003230000-0x0000000003240000-memory.dmp
memory/4280-31-0x0000000008210000-0x000000000888A000-memory.dmp
memory/4280-7-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/4280-5-0x0000000005870000-0x0000000005892000-memory.dmp
memory/4280-15-0x0000000006280000-0x00000000065D4000-memory.dmp
memory/4280-16-0x00000000068B0000-0x00000000068CE000-memory.dmp
memory/4280-17-0x00000000068E0000-0x000000000692C000-memory.dmp
memory/4280-18-0x000000007FBE0000-0x000000007FBF0000-memory.dmp
memory/4280-19-0x0000000006E80000-0x0000000006EB2000-memory.dmp
memory/4280-4-0x0000000005920000-0x0000000005F48000-memory.dmp
memory/4280-20-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4280-29-0x0000000007A70000-0x0000000007A8E000-memory.dmp
memory/4280-30-0x0000000007AC0000-0x0000000007B63000-memory.dmp
memory/4280-6-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/4280-32-0x0000000007BD0000-0x0000000007BEA000-memory.dmp
memory/4280-33-0x0000000007C40000-0x0000000007C4A000-memory.dmp
memory/4280-34-0x0000000007E50000-0x0000000007EE6000-memory.dmp
memory/4280-35-0x0000000007DD0000-0x0000000007DE1000-memory.dmp
memory/4280-36-0x0000000007E00000-0x0000000007E0E000-memory.dmp
memory/4280-37-0x0000000007E10000-0x0000000007E24000-memory.dmp
memory/4280-38-0x0000000007F10000-0x0000000007F2A000-memory.dmp
memory/4280-39-0x0000000007EF0000-0x0000000007EF8000-memory.dmp
memory/4280-3-0x0000000003230000-0x0000000003240000-memory.dmp
memory/4280-2-0x0000000003280000-0x00000000032B6000-memory.dmp
memory/4280-1-0x0000000003230000-0x0000000003240000-memory.dmp