Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 13:53
General
- Target KD202411130055-1.js
- Size 453KB
- Sample260930-q7frbstbkd
- SHA256 49308c3534268b0f2b44bcd7d11938f2df9457f1fab60cab3fe1c7ce826cac47
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
lg.sonqhong.com:80
-
lg.sonqhong.com:443
-
lg.sonqhong.com:8080
-
8KlUBhFQHvym
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs
Network activity triggered a Suricata alert
- Async RAT payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\KD202411130055-1.js1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\iw0ck3il\iw0ck3il.ps1"2⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
iw0ck3il.ps1
memory/4368-21-0x000001DCA2D20000-0x000001DCA2D3E000-memory.dmp
memory/4368-23-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-4-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-5-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-8-0x000001DC8A6A0000-0x000001DC8A6C2000-memory.dmp
memory/4368-9-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-10-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-11-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-12-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-13-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-2-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-17-0x000001DCA29C0000-0x000001DCA29DE000-memory.dmp
memory/4368-18-0x000001DCA29E0000-0x000001DCA2A92000-memory.dmp
memory/4368-19-0x000001DCA2AA0000-0x000001DCA2AAA000-memory.dmp
memory/4368-20-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-1-0x00007FFC5106F000-0x00007FFC51070000-memory.dmp
memory/4368-3-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-24-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-22-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-25-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-26-0x000001DCA2D00000-0x000001DCA2D0A000-memory.dmp
memory/4368-27-0x000001DCA2D60000-0x000001DCA2D7C000-memory.dmp
memory/4368-29-0x000001DCA2D40000-0x000001DCA2D46000-memory.dmp
memory/4368-30-0x000001DCA2D50000-0x000001DCA2D5A000-memory.dmp
memory/4368-28-0x000001DCA2D10000-0x000001DCA2D18000-memory.dmp
memory/4368-31-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-32-0x000001DCA2DB0000-0x000001DCA2DC2000-memory.dmp
memory/4368-36-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-37-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-38-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-39-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-40-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp
memory/4368-41-0x00007FFC50EE0000-0x00007FFC51884000-memory.dmp