0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (3)

• C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\argus-vr-agent\quarantine\0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9_extracted\0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.exe

Dropped files (1)

• C:\Users\lab\AppData\Local\Temp\tgbzvzfbuua.ps1

MITRE ATT&CK

Indicators of Compromise (defanged)

• 1f7c4122131ba1c798fe09827fe1ee9b
• 702ce7777c83b63a0d20ffbf80b439394b712e64
• C:\Users\lab\AppData\Local\Temp\tgbzvzfbuua.ps1

IOCs (JSON)Copy

{
  "sha256": "0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9",
  "family": "AsyncRAT",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "executable-drop",
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1105",
    "T1059",
    "T1027.002"
  ],
  "dropped": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\tgbzvzfbuua.ps1"
  ],
  "children": [
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe",
    "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
    "C:\\argus-vr-agent\\quarantine\\0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9_extracted\\0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.exe"
  ]
}