asyncrat | 8278267d4c89fc28db6b5c32b4c4b9b326ca1d9465e9d06c22de0f539b0c4a9f

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/03/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msedge_exe.exe
Size 129KB
Sample260301-kldrysgs4e
SHA256 8278267d4c89fc28db6b5c32b4c4b9b326ca1d9465e9d06c22de0f539b0c4a9f
MD5 3ea00e94751de1a42a58a6d9edeac80d
SHA1 59f718c68ffc12a96042ac719fd1778a067a7a01
SHA512 1d292c6dbde676a14ba0a055568181eabf05d3a1ac2565356a5c51cd88dec3709256a526a1f83c2f61d9ff10d017ed012371bf15613f848964bded3a61eb7196
SSDEEP 3072:IfDefLBnAGbbQA2oFRUORWBToN1UniyimyzbY:K8LBAkbAIRbUaURy/
TLSH
T131D3AF003788DDD5E41CCBF4ECA2A64106B4CE7A2142C79D3CD469FF7B8AAC58515BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vinohaven defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

VinoHaven

quibrigalqui.za.com :4872
quibrigalqui.za.com :3389
quibrigalqui.za.com :445
quibrigalqui.za.com :22
quibrigalqui.za.com :443
quibrigalqui.za.com :80
quibrigalqui.za.com :21
quibrigalqui.za.com :1604
quibrigalqui.za.com :200
innovate.uk.net :4872
innovate.uk.net :3389
innovate.uk.net :445
innovate.uk.net :22
innovate.uk.net :443
innovate.uk.net :80
innovate.uk.net :21
innovate.uk.net :1604
innovate.uk.net :200

Mutex

VinoHaven_VintageMutex_v3228

Attributes

delay
1
install
true
install_file
msedge_exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001a00000002b468-10.dat	family_asyncrat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5768	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe
5928	msedge_exe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	msedge_exe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5928 wrote to memory of 5236	5928	msedge_exe.exe	83
PID 5928 wrote to memory of 4620	5928	msedge_exe.exe	85
PID 5236 wrote to memory of 776	5236	cmd.exe	87
PID 4620 wrote to memory of 5768	4620	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\msedge_exe.exe
"C:\Users\Admin\AppData\Local\Temp\msedge_exe.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msedge_exe" /tr '"C:\Users\Admin\AppData\Roaming\msedge_exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "msedge_exe" /tr '"C:\Users\Admin\AppData\Roaming\msedge_exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2E8D.tmp.bat""
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp2E8D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2E8D.tmp.bat
Size 150B
SHA256 057f3fed4ef56333d285cb745b96587e8888405997c4357831f556c7193e0d8d
MD5 394f437c7b446f2fda934ac4a0cd5808
SHA1 6b1294b995d3f6397c9a8317ee16ba136f39c1ad
SHA512 1561fcc11737195be1b85cef7bfea1c0c7c238e7d60b5cfcd7e20c1001da334c5657ab728e45767f47e5b0b29ab029048cdd85f19b14c7893641b8183d7b8644
TLSH
T1ABC02B4363C5EA6F2805143302FAD48DD1726C1D3F44BB10C308400D238044CF0E9341
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_exe

Path C:\Users\Admin\AppData\Roaming\msedge_exe
Size 129KB
SHA256 8278267d4c89fc28db6b5c32b4c4b9b326ca1d9465e9d06c22de0f539b0c4a9f
MD5 3ea00e94751de1a42a58a6d9edeac80d
SHA1 59f718c68ffc12a96042ac719fd1778a067a7a01
SHA512 1d292c6dbde676a14ba0a055568181eabf05d3a1ac2565356a5c51cd88dec3709256a526a1f83c2f61d9ff10d017ed012371bf15613f848964bded3a61eb7196
SSDEEP 3072:IfDefLBnAGbbQA2oFRUORWBToN1UniyimyzbY:K8LBAkbAIRbUaURy/
TLSH
T131D3AF003788DDD5E41CCBF4ECA2A64106B4CE7A2142C79D3CD469FF7B8AAC58515BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2288-12-0x0000029F15FA0000-0x0000029F1674E000-memory.dmp

Download

memory/4620-11-0x00000221D60E0000-0x00000221D688E000-memory.dmp

Download

memory/5928-0-0x0000000000310000-0x0000000000336000-memory.dmp

Download

memory/5928-1-0x0000000000C70000-0x0000000000C80000-memory.dmp

Download

memory/5928-9-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

Download

memory/5928-6-0x000000001AFA0000-0x000000001B74E000-memory.dmp

Download

memory/5928-8-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Download