asyncrat | hxxps://github[.]com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases/tag/v0[.]5[.]8

Analysis

max time kernel
395s
max time network
369s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases/tag/v0.5.8

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:8080

192.168.1.1:6606

192.168.1.1:7707

192.168.1.1:8808

192.168.1.1:8080

Mutex

ebrE27bbh557

Attributes

delay
3
install
true
install_file
OPP.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000000707-299.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AsyncClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 4 IoCs

pid	Process
1700	AsyncClient.exe
5712	AsyncClient.exe
5728	OPP.exe
5336	OPP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	5620	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5644	timeout.exe
3040	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 5a003100000000009659d16b10004173796e635241540000420009000400efbe9659c96b9659d36b2e000000453d0200000007000000000000000000000000000000be7ddd004100730079006e006300520041005400000018000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "7"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5a003100000000009659c96b1000434f4d50494c45440000420009000400efbe9659c96b9659c96b2e000000443d0200000007000000000000000000000000000000ff9b610043004f004d00500049004c0045004400000018000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	AsyncRAT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5628	schtasks.exe
5188	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5336	OPP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1488	msedge.exe
1488	msedge.exe
2716	identity_helper.exe
2716	identity_helper.exe
1776	msedge.exe
1776	msedge.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
1700	AsyncClient.exe
5712	AsyncClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AsyncRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	AsyncClient.exe
Token: SeDebugPrivilege	5712	AsyncClient.exe
Token: SeDebugPrivilege	5336	OPP.exe
Token: SeDebugPrivilege	3004	AsyncRAT.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
3004	AsyncRAT.exe
3004	AsyncRAT.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	AsyncRAT.exe
5336	OPP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2404	1488	msedge.exe	83
PID 1488 wrote to memory of 2404	1488	msedge.exe	83
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 4592	1488	msedge.exe	84
PID 1488 wrote to memory of 1780	1488	msedge.exe	85
PID 1488 wrote to memory of 1780	1488	msedge.exe	85
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86
PID 1488 wrote to memory of 2364	1488	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases/tag/v0.5.8
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd1c046f8,0x7fffd1c04708,0x7fffd1c04718
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,6352694590284731034,14356143375255318995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4604

C:\Users\Admin\Downloads\COMPILED\AsyncRAT\AsyncRAT.exe
"C:\Users\Admin\Downloads\COMPILED\AsyncRAT\AsyncRAT.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5376

C:\Users\Admin\Downloads\COMPILED\AsyncRAT\Stub\Stub.exe
"C:\Users\Admin\Downloads\COMPILED\AsyncRAT\Stub\Stub.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 780
  2⤵
  - Program crash
  PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5620 -ip 5620
1⤵
PID:5712

C:\Users\Admin\Downloads\AsyncClient.exe
"C:\Users\Admin\Downloads\AsyncClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OPP" /tr '"C:\Users\Admin\AppData\Local\Temp\OPP.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "OPP" /tr '"C:\Users\Admin\AppData\Local\Temp\OPP.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFA11.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5400
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5644
- - C:\Users\Admin\AppData\Local\Temp\OPP.exe
    "C:\Users\Admin\AppData\Local\Temp\OPP.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5728

C:\Users\Admin\Downloads\AsyncClient.exe
"C:\Users\Admin\Downloads\AsyncClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OPP" /tr '"C:\Users\Admin\AppData\Local\Temp\OPP.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "OPP" /tr '"C:\Users\Admin\AppData\Local\Temp\OPP.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp148E.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:232
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\OPP.exe
    "C:\Users\Admin\AppData\Local\Temp\OPP.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AsyncClient.exe.log

Filesize
614B

MD5
54920f388010333559bdff225040761d

SHA1
040972bf1fc83014f10c45832322c094f883ce30

SHA256
9ed5449a36700939987209c7a2974b9cc669b8b22c7c4e7936f35dda0a4dc359

SHA512
e17aa5d1328b3bfd3754d15b3c2eded98653d90c7b326f941522e0b3bd6f557880246a6bc69047facb42eb97d2e0ed6c46148dfe95a98669fc4e1d07c21a285c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3df4c7692d53afed533cf1a7b1b2571a

SHA1
bdbbdddae7e647c894ae04c61abcefa9f88da8b8

SHA256
757e19b6ba6f319febabe6e1d302caee7c47a1ade185188d87264cf2ac3adcc9

SHA512
79365e18553f8e9fe60a9758d66156e291063d7f95e5b29c303a32cb83731b81e29d7f76c7936541abcc6968fb6c4791ae6a0f0d981f69cb77428f95a5797ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
5022b10efc3c6d669ded7960cc594a19

SHA1
a79ad985b345f09f5f4f265ba1867800ab4d3be1

SHA256
a6c395932ed70d3a45247d91c6593b48d6d389a52aa806ad484aef62b63c8e53

SHA512
a496101a7c30b7205f91698eec23c53b52d80a24a2208f3184733b905fd34066163df9688e00856278fc536fd955bcb0d2c62f3561f28718e378a08754c53c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5eeebd4a335fd8d9c82aefec6f78c4c6

SHA1
6be2fb5c015a3629e3c5996c66d638427551d263

SHA256
31f341aba4fb3395703ef8493bab591ddc1a228b7df843a23719227187dc10e2

SHA512
5dd2b682906fcdcc21fe5d429374eb2e50af5286adc429672392ed9a30c0af98d0d5e300e839ee45bae863609a3d69220ec3dec8b1a8774321de81f33b630984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
953de923157b0e45f673557360d9564e

SHA1
a4700112ba6d050df9a198010608d60f7879bc56

SHA256
4d4c2ebe6e7f10b89d5c2ff49d7a0e2e889c485892b69684aae402cc3d6ff7f4

SHA512
1bf281e9c8699861eeb4d602f50fd6ee26824e30a34c3a7e440e92a5622adb10ef53d15b7f94bdfdf146960dfde2b2ecad786f6467885d3b2ed9bcf3ca3c7c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
3c74126e7137bc83fe9263b099d4d760

SHA1
2e860dd99c28c45fd0cb8f955d1aae10131b5013

SHA256
f1b81ca584da690a64eeb5e8237ffd270861f26ad603b54aec2be408a2ce5655

SHA512
9e6fbd125d5faeeb9230e1e102bad4c6c9989d783896f6b12a8ef3f59f5acc3e5743e7aa5aa4d913a5d04d1b0f7d1cbdf4eadb057f97aee5b7d7e02ff298c299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590a66.TMP

Filesize
874B

MD5
7dcfacb4dcfede54ce8847dfe6da112b

SHA1
1f2aa54db85cfb218cffa8f12df5ef259085096d

SHA256
d9ed0cdbb6db84f6926cece804fab8ee71b33726527a2353f3770838dc753640

SHA512
d5585d7f9eb1e6b2fe60bf9eecaec1271bbe04251ce3a94cb164e440ee03482fe3a49a96a50f495d93d6bb28fb9c57906caa3f6cacdfdabea21364cbfd542633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
544cae2dbd9f1928a9ec5f7526fea74d

SHA1
da87e26ea6791f0d589302dce6e371786087c283

SHA256
f3b084c0c5dc7918f6e684dc442789f6ae3ba98c6c7278799212fb5ffb49e226

SHA512
30e894c753fe458b1acee31acaddf73bcb103d74c73895e6ed261624258398917aff176711692039ed7ea5f21bebdb44841e424ca61ae9f92f1c439ed82035b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad2409bafe61a97ce131eb430ed38073

SHA1
80d729b1d65f646f5394b71e14a4860d02a47211

SHA256
3f550c8f83acb95e565605be19f43ebe97d7d9d4c207749d0297b280ea5baa41

SHA512
b5e1c4bde2b127dbe1b534d8f20a2a944b330419679b8b3bf644b6f469216cb464ceaafb7dbc908401b17d249e0e57eb82d6ab6b4085b1afe8a75ee3a15905a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53b11a9406796fc6d9fde4d55adbcd6c

SHA1
657937520e697a882ca2627a165f4e22a4783809

SHA256
0dc30ebac90a7d97eb76dc354e6c9969a18771b3c4858a52834bf2d743a4646b

SHA512
d1d6a35b1fbeaeb7abb0f92ce6ec0edace41e9fd7fb27ad37e9c7348743e29c28b3c853ff5197b06c17debe409f1ec140022ff039176aa81077d9e0f663661be

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_rlcfuditezizgbmskmstccdixoxy2jyu\0.5.8.0\user.config

Filesize
707B

MD5
6bab53f4f7736feb7c524030e0cd7b13

SHA1
adbf6440706efa4371ee2f00f4f70749459fa05d

SHA256
e470e4f2273f11763453a7e2eb9b6d11857159e1fc001d13decfddb254437cd7

SHA512
2b3145d10399ecc0d56499c9759380248087892c67334b8baeef77e11fdf3dc4f70c5459b6e3dfb4b0ba33b07ef6f1fdcd845551248de75093859237db6e4b04

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_rlcfuditezizgbmskmstccdixoxy2jyu\0.5.8.0\user.config

Filesize
319B

MD5
f71f55112253acc1ef2ecd0a61935970

SHA1
faa9d50656e386e460278d31b1d9247fdd947bb7

SHA256
d1ad588a08c8c0799d7a14509f1e0a7ae04c519102ed9d328a83fe65999e6179

SHA512
761b5c13e39bd4ae21d298084bbe747ae71c383fedf9a51fd5e9723a8b3b4547de459d82bac7f3f8f3bfc11cfb0528a4f1057b51996d7d046583109a53317b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp148E.tmp.bat

Filesize
150B

MD5
c09f9b86162028d620fa279804828ef0

SHA1
4f6279a54f45025caff75a32189da54a3a67cdfc

SHA256
5061a8a233ba1ae9ec397ddd1bc2e83697c0aff641803eab9fc70afefffc19e5

SHA512
f23bc7d57ccebacadd3e9b2220d2e148d6387683b7d03d6a77d6a57bb531be3a8b073290f99fb14df2927ac1842f93ce8dfa6e4551c990c0fe6d10a8b39ad29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFA11.tmp.bat

Filesize
150B

MD5
49c6fd1156ba40be97a219a370010a62

SHA1
f48f59e1e82159ac5b9702f94ba91dee35874cac

SHA256
ce4cab81fb29361886889585278f4dddd58624178f0dac9523c5bf0a2a33fbb1

SHA512
52aceb92dd1e7c2a944cd550f513d718afd123a3c56f3911134dd20d925ddba222f7280a7d03da8e0d7100444cfdc8c3305a5eae0e90d45747000b599fa61033

Download Submit
C:\Users\Admin\Downloads\AsyncClient.exe

Filesize
47KB

MD5
2607ed5a1936948c492358a9b6dcea52

SHA1
8a8b34f684ae967352981cad76006ce4e1f58917

SHA256
65fe2b597e3a5e28fa2c702e9f7e78979302e77aa14f94073762fc88db31035a

SHA512
1eb463d474e07f599acb0950f3d31d1af9df8cbaa1a9a8706e60ea983fed5d8d5d6bc91083e532637ab7f7860fd4e68353b706567c95c40547e2064897df45d5

Download Submit
C:\Users\Admin\Downloads\COMPILED.zip

Filesize
6.9MB

MD5
30b1961a9b56972841a3806e716531d7

SHA1
63c6880d936a60fefc43a51715036c93265a4ae5

SHA256
0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c

SHA512
9449065743226bd15699e710b2bab2a5bb44866f2d9a8bd1b3529b7c53d68e5ecba935e36406d1b69e1fb050f50e3321ef91bc61faac9790f6209fec6f930ed0

Download Submit
C:\Users\Admin\Downloads\COMPILED\AsyncRAT\ServerCertificate.p12

Filesize
4KB

MD5
24ddcac5d89e91f83a40515ac91f568c

SHA1
9d6c955373fe8e39767f5b4eb6ff394496bff27c

SHA256
34924917117f03414b2656974dfd2995d7df8f0514949aba0970c275243abad6

SHA512
e7f240b9ef48b0729982f81ac7536d53bb4c6f981874d35c4b5005775b03581fc40494283e20d092f9b11b5932e7b3cc6923e773be2d578e99b3a6c11a11458d

Download Submit
memory/1700-301-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/1700-302-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Filesize
408KB

Download
memory/1700-303-0x0000000005450000-0x00000000054EC000-memory.dmp

Filesize
624KB

Download
memory/3004-267-0x000002AB82C90000-0x000002AB82DB6000-memory.dmp

Filesize
1.1MB

Download
memory/3004-187-0x000002AB80000000-0x000002AB80280000-memory.dmp

Filesize
2.5MB

Download
memory/3004-186-0x000002ABFCAA0000-0x000002ABFCAB2000-memory.dmp

Filesize
72KB

Download
memory/3004-185-0x000002ABE3E60000-0x000002ABE3E6A000-memory.dmp

Filesize
40KB

Download
memory/3004-161-0x000002ABFC750000-0x000002ABFC9A2000-memory.dmp

Filesize
2.3MB

Download
memory/3004-159-0x000002ABE19B0000-0x000002ABE201A000-memory.dmp

Filesize
6.4MB

Download
memory/5336-321-0x0000000005C00000-0x00000000061A4000-memory.dmp

Filesize
5.6MB

Download
memory/5336-322-0x0000000006670000-0x00000000066E6000-memory.dmp

Filesize
472KB

Download
memory/5336-323-0x00000000065F0000-0x0000000006658000-memory.dmp

Filesize
416KB

Download
memory/5336-324-0x0000000006700000-0x000000000671E000-memory.dmp

Filesize
120KB

Download
memory/5336-325-0x0000000006840000-0x00000000068D2000-memory.dmp

Filesize
584KB

Download
memory/5336-327-0x0000000006E80000-0x0000000006EE2000-memory.dmp

Filesize
392KB

Download
memory/5336-328-0x0000000007040000-0x000000000704A000-memory.dmp

Filesize
40KB

Download
memory/5336-329-0x00000000064B0000-0x0000000006514000-memory.dmp

Filesize
400KB

Download
memory/5336-330-0x0000000006560000-0x00000000065C2000-memory.dmp

Filesize
392KB

Download
memory/5620-243-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download