Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 03:34
General
- Target KD202411130055-1.js
- Size 453KB
- Sample260930-d4s62atfpe
- SHA256 49308c3534268b0f2b44bcd7d11938f2df9457f1fab60cab3fe1c7ce826cac47
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
lg.sonqhong.com:80
-
lg.sonqhong.com:443
-
lg.sonqhong.com:8080
-
8KlUBhFQHvym
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\KD202411130055-1.js1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\0gr1vt2i\0gr1vt2i.ps1"2⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0gr1vt2i.ps1
memory/2096-27-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-21-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-6-0x000001A57B170000-0x000001A57B192000-memory.dmp
memory/2096-7-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-2-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-9-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-10-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-11-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-12-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-13-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-14-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-15-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-19-0x000001A57B450000-0x000001A57B502000-memory.dmp
memory/2096-20-0x000001A57B510000-0x000001A57B51A000-memory.dmp
memory/2096-18-0x000001A57B430000-0x000001A57B44E000-memory.dmp
memory/2096-29-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-22-0x000001A57B790000-0x000001A57B7AE000-memory.dmp
memory/2096-23-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-24-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-25-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-26-0x000001A57B770000-0x000001A57B77A000-memory.dmp
memory/2096-1-0x00007FF9322FF000-0x00007FF932300000-memory.dmp
memory/2096-3-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-28-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-47-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-31-0x000001A57B780000-0x000001A57B788000-memory.dmp
memory/2096-32-0x000001A57B7B0000-0x000001A57B7B6000-memory.dmp
memory/2096-33-0x000001A57B7C0000-0x000001A57B7CA000-memory.dmp
memory/2096-34-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-35-0x000001A57AEE0000-0x000001A57AEF2000-memory.dmp
memory/2096-37-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-38-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-41-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-42-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-43-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-44-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-45-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-46-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-30-0x000001A57B7D0000-0x000001A57B7EC000-memory.dmp
memory/2096-48-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-49-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-50-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-51-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-52-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-53-0x00007FF932170000-0x00007FF932B14000-memory.dmp
memory/2096-54-0x00007FF932170000-0x00007FF932B14000-memory.dmp