Analysis
- max time kernel
58s - max time network
17s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 19:34
General
- Target d5d976e2db3dc394cba1c028102e861e9487e3cda0a1604006b29255c4aec048.exe
- Size 69KB
- Sample261030-x997aaex71
- SHA256 d5d976e2db3dc394cba1c028102e861e9487e3cda0a1604006b29255c4aec048
Malware Config
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5d976e2db3dc394cba1c028102e861e9487e3cda0a1604006b29255c4aec048.exe"C:\Users\Admin\AppData\Local\Temp\d5d976e2db3dc394cba1c028102e861e9487e3cda0a1604006b29255c4aec048.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpA28B.tmp
memory/4904-3-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-2-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-1-0x00007FFE79ABF000-0x00007FFE79AC0000-memory.dmp
memory/4904-4-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-5-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-6-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-7-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-8-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-0-0x00000000004B0000-0x00000000004C8000-memory.dmp
memory/4904-22-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-23-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-24-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-25-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp