Analysis
- user interaction
yes - max time kernel
68s - max time network
72s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/10/2026, 19:20
General
- Target 136bfdf68486a6b8d9acaaf957c4936f4364953c148a7de195b791c875b83452.exe
- Size 23.6MB
- Sample261010-x2a28ahs3j
- SHA256 136bfdf68486a6b8d9acaaf957c4936f4364953c148a7de195b791c875b83452
Malware Config
Extracted
-
njrat
-
0.7d
-
HacKed
-
letaryzipthone.ddns.net:6969
-
7ee6e172b1c9617c7199ef7dab81a556
-
reg_key
7ee6e172b1c9617c7199ef7dab81a556
-
splitter
|'|'|
Extracted
-
asyncrat
-
1.0.7 - modded by last
-
Default
-
letaryzipthone.ddns.net:9899
-
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
RuntimeBroker.exe
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Async RAT payload 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 33 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\136bfdf68486a6b8d9acaaf957c4936f4364953c148a7de195b791c875b83452.exe"C:\Users\Admin\AppData\Local\Temp\136bfdf68486a6b8d9acaaf957c4936f4364953c148a7de195b791c875b83452.exe"1⤵
- Executes a file named after a Windows system binary
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\LetterGoat - Test Mail V8 .exe"C:\Users\Admin\AppData\Roaming\LetterGoat - Test Mail V8 .exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_4972_134361336483935974\open-source.exe"C:\Users\Admin\AppData\Roaming\LetterGoat - Test Mail V8 .exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Users\Admin\AppData\Roaming\PresentationFontCache.exe"C:\Users\Admin\AppData\Roaming\PresentationFontCache.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\PresentationFontCache.exe" "PresentationFontCache.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\PresentationFontCache.exe"C:\Users\Admin\AppData\Roaming\PresentationFontCache.exe" ..1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F41⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QtCore.pyd
QtGui.pyd
QtWidgets.pyd
_bz2.pyd
_hashlib.pyd
libcrypto-3.dll
libssl-3.dll
_elementpath.pyd
etree.pyd
unicodedata.pyd
MSVCP140_2.dll
sip.pyd
Qt6Core.dll
Qt6Gui.dll
Qt6Widgets.dll
VCRUNTIME140.dll
_elementtree.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
msvcp140.dll
msvcp140_1.dll
open-source.exe
pyexpat.pyd
python3.dll
python312.dll
select.pyd
vcruntime140_1.dll
LetterGoat - Test Mail V8 .exe
PresentationFontCache.exe
RuntimeBroker.exe
memory/2780-158-0x00000000010E0000-0x00000000010F0000-memory.dmp
memory/2780-30-0x00000000010E0000-0x00000000010F0000-memory.dmp
memory/4176-1-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4176-2-0x0000000000580000-0x0000000001D26000-memory.dmp
memory/4176-4-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4176-0-0x00007FFD5B52F000-0x00007FFD5B530000-memory.dmp
memory/4176-5-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4176-3-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4176-31-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4288-142-0x00007FFD57FA0000-0x00007FFD585D6000-memory.dmp
memory/4288-152-0x00007FFD5D320000-0x00007FFD5D592000-memory.dmp
memory/4288-155-0x00007FF6087E0000-0x00007FF60994B000-memory.dmp
memory/4288-147-0x00007FFD585E0000-0x00007FFD58AB6000-memory.dmp
memory/4288-165-0x00007FF6087E0000-0x00007FF60994B000-memory.dmp
memory/4620-29-0x0000029F1E4A0000-0x0000029F1E4B6000-memory.dmp
memory/4972-154-0x00007FF6B11F0000-0x00007FF6B2990000-memory.dmp
memory/4972-194-0x00007FF6B11F0000-0x00007FF6B2990000-memory.dmp