Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 22:40
General
- Target Size label (Heat Transfer) style 1178875.xlsx.js
- Size 2.6MB
- Sample260930-2ln2csy17p
- SHA256 7efba299adeb2b2bd73ce0f2542e30e36b5719d13c54011b4b3959efd5699952
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
217.60.76.250:6606
-
217.60.76.250:7707
-
217.60.76.250:8808
-
ZcMyazpufH2A
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Size label (Heat Transfer) style 1178875.xlsx.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\UIUEPBXLWCBXZTKG.exe"C:\Users\Admin\Documents\UIUEPBXLWCBXZTKG.exe" C:\Users\Admin\Documents\GKTZXBCWLXBPEUIU2⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GKTZXBCWLXBPEUIU
UIUEPBXLWCBXZTKG.exe
memory/4320-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4320-1208-0x0000000074A42000-0x0000000074A43000-memory.dmp
memory/4320-1209-0x0000000027220000-0x0000000027232000-memory.dmp
memory/4320-1210-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/4320-1211-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/4320-1212-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/4320-1214-0x0000000074A42000-0x0000000074A43000-memory.dmp
memory/4320-1215-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/4320-1218-0x000000002A470000-0x000000002A50C000-memory.dmp
memory/4320-1219-0x000000002A510000-0x000000002AACA000-memory.dmp
memory/4320-1220-0x000000002AAD0000-0x000000002AB36000-memory.dmp
memory/4320-1221-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/4320-1222-0x0000000074A30000-0x00000000751EC000-memory.dmp
memory/5096-8-0x000001F629930000-0x000001F629D4E000-memory.dmp