asyncrat | 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc

Analysis

user interaction
yes
max time kernel
346s
max time network
369s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinNetSvc_e4a53f.exe
Size 202.7MB
Sample260418-phcspsht6q
SHA256 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc
MD5 6393a9b9173d447feda7166c5b605876
SHA1 09384613a83e1525d11baa0f994f09d653c6e759
SHA512 27b62ce2165a9e88915f9b6cd93878ce93a9c6ec0dcddc229729aaf28760d0761982ce547f89ec90a1ed9c0934825640f2ae28ae1faca6519ca9526e67177a0b
SSDEEP 3145728:6VPnE9X6KPuUxWacIC0Jh1W6zODQ9NqguZgnNR5hKe6Ls+4HXQNvqq:n9X6KPuTacCJG6IC/+s+Mcqq
TLSH
T131A8CF1163E86E45E27B8278977782A1D6B5BC525311C2CF0094FD4A3F73BC2BA36366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0003000000000345-26.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0003000000000345-26.dat	family_stormkitty
behavioral1/memory/1752-28-0x0000000000A60000-0x0000000000DAA000-memory.dmp	family_stormkitty

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	WinNetSvc_e4a53f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	WinNetSvc_cb04d0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	almohtraf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	WinNetSvc_795c50.exe

Executes dropped EXE 6 IoCs

pid	Process
916	WinNetSvc_cb04d0.exe
1752	almohtraf.exe
3432	almtmiz.exe
416	almtmiz.exe
4592	WinNetSvc_795c50.exe
5948	almohtraf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	cmd.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
3528	timeout.exe
4452	timeout.exe
2436	timeout.exe
5840	timeout.exe
792	timeout.exe
3832	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4224	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
1752	almohtraf.exe
3432	almtmiz.exe
3432	almtmiz.exe
3432	almtmiz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	WinNetSvc_e4a53f.exe
Token: SeDebugPrivilege	916	WinNetSvc_cb04d0.exe
Token: SeDebugPrivilege	1752	almohtraf.exe
Token: SeDebugPrivilege	3432	almtmiz.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	4592	WinNetSvc_795c50.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
916	WinNetSvc_cb04d0.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3572	WinNetSvc_e4a53f.exe
3572	WinNetSvc_e4a53f.exe
916	WinNetSvc_cb04d0.exe
916	WinNetSvc_cb04d0.exe
3432	almtmiz.exe
4592	WinNetSvc_795c50.exe
4592	WinNetSvc_795c50.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 916	3572	WinNetSvc_e4a53f.exe	93
PID 3572 wrote to memory of 5024	3572	WinNetSvc_e4a53f.exe	94
PID 5024 wrote to memory of 3528	5024	cmd.exe	96
PID 5024 wrote to memory of 3640	5024	cmd.exe	97
PID 3640 wrote to memory of 1128	3640	net.exe	98
PID 5024 wrote to memory of 6140	5024	cmd.exe	99
PID 5024 wrote to memory of 4452	5024	cmd.exe	100
PID 5024 wrote to memory of 1752	5024	cmd.exe	101
PID 1752 wrote to memory of 3248	1752	almohtraf.exe	103
PID 1752 wrote to memory of 1052	1752	almohtraf.exe	105
PID 3248 wrote to memory of 1292	3248	cmd.exe	107
PID 1052 wrote to memory of 2436	1052	cmd.exe	108
PID 1052 wrote to memory of 416	1052	cmd.exe	111
PID 916 wrote to memory of 764	916	WinNetSvc_cb04d0.exe	112
PID 764 wrote to memory of 4224	764	cmd.exe	114
PID 764 wrote to memory of 5840	764	cmd.exe	115
PID 916 wrote to memory of 4592	916	WinNetSvc_cb04d0.exe	116
PID 916 wrote to memory of 5932	916	WinNetSvc_cb04d0.exe	117
PID 5932 wrote to memory of 792	5932	cmd.exe	119
PID 5932 wrote to memory of 5232	5932	cmd.exe	120
PID 5232 wrote to memory of 5160	5232	net.exe	121
PID 5932 wrote to memory of 4116	5932	cmd.exe	122
PID 5932 wrote to memory of 3832	5932	cmd.exe	123
PID 5932 wrote to memory of 5948	5932	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe
"C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\WinNetSvc_cb04d0.exe
  "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_cb04d0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c taskkill /F /IM "WinNetSvc_e4a53f.exe" & timeout /t 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "WinNetSvc_e4a53f.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\WinNetSvc_795c50.exe
    "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_795c50.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:792
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5160
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "WinServiceSyncTask" /F
      4⤵
      PID:4116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3832
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
      "almohtraf.exe"
      4⤵
      Executes dropped EXE
      PID:5948
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3528
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1128
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WinServiceSyncTask" /F
    3⤵
    PID:6140
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
    "almohtraf.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7948.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2436
    - - C:\Users\Admin\AppData\Roaming\almtmiz.exe
        
        "C:\Users\Admin\AppData\Roaming\almtmiz.exe"
        5⤵
        Executes dropped EXE
        
        PID:416

C:\Users\Admin\AppData\Roaming\almtmiz.exe
"C:\Users\Admin\AppData\Roaming\almtmiz.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

almohtraf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\almohtraf.exe.log
Size 1KB
SHA256 92b180b8361d51600dc558c783b554fb3be7dd585e8376dfe341b483c8bcdb42
MD5 ae95e1c046164d5ece9c36e7e517aaa3
SHA1 251f878d5335639e698c2dc07f448159f0f3f7f9
SHA512 b9cab1e89615fa4d2dfe7cc7678cee5e8f12db3f533fce2c3a64edcf32228c1a15d3216191eb1e2303e54910ba0514a3a40472ce81254be17e7aef1e1f527d22
TLSH
T1DE31B97133B6A1D889162F461C6C25C013BF4329B990AE0C7AA8A25EDD2B4075F312F2
MD5 SHA1 SHA512 TLSH

Submit Download

2lelp31z.414

Path C:\Users\Admin\AppData\Local\Temp\2lelp31z.414
Size 474B
SHA256 240098e7033b5f20c8c5936ecb68cc1049f1ecc34af536995b52a93175249150
MD5 46f522c77d1a514703a7fed0015fc623
SHA1 ed22f0a5884ff7445f4e171e1e49e0af608e0fda
SHA512 09aec723bf6f79c3926300c64b9b70f67d7190fcb75d53b32ffd2d4803515dabb014cab50cf2924a366c0c73ac2187c4a393790cdf3d4b989146f6b310d3c90f
TLSH
T1BCF02E00C4D4E976477205913FEBF510576D132304C90A4578A4BDA79F955D64947075
MD5 SHA1 SHA512 TLSH

Submit Download

tmp7948.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7948.tmp.bat
Size 151B
SHA256 b2aeaad88bd8d0e09195f0bb8440b5ab9e23ac580b3922437a77e44d11b34969
MD5 1016e9d2966c8082e95a6430dce4c3f2
SHA1 4c97ec0f368d14e77e64777f96de3e6acef4c3a1
SHA512 07762b460bd3497576eb728161257ab96061ea1fffcf39e75c391320f38529c18b302a75375f2074064e459a342409bc8a493d6d9f427f88d0cf757e37d12c84
TLSH
T182C02B5261C5EB1E7905183302FBD4CDB1726D193F40BF10CB05404D1280448F4D9381
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat
Size 988B
SHA256 d710692ad33516739d9d492d494fb87054559d51f9f5de117dc9675d74d41c5c
MD5 684c0e1e40451ca9da7ec67358b53f01
SHA1 9a96498fadde3c37adeb142df1a58d2e12b1f24e
SHA512 0784137761157f370769ade0d27b6e4535c32c5cfedd085298521078660e979c93c7825246be58cbcf52f5eed5a215ca11ef27f23fe7c041c0d7676422eba53f
TLSH
T1341125511D2644121353BD76C2533455F4B99E131E16E458F4D350904FBF286D5CE6F6
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
Size 3.3MB
SHA256 8ce93a19ce487452698e76a063759f89281d241dc51bf2b2e62c6ed275dbfaaf
MD5 26280b3a6e26806d41644e9d6a54456e
SHA1 1c3d412f08b536744be948db3fb53b64050022a3
SHA512 72d97cb072192d56a01a610ae42b01d959a6fbcb9694393125e4ae2476fdf61f7699dbd630b2d73b6c02cca072742c5b8442366d87a90b9666984cf403c767e8
SSDEEP 49152:geMAR4e3jG7Pk12ShzPMAzU0mdBdo+6WuDayPtr/NJJc:gQ3y7TS9x
TLSH
T1F5F54B416BE8CE1BE1BF2775A4F201111BB1E449A732D78F1698E6792C637406D0A3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkg_data.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\pkg_data.dat
Size 1.2MB
SHA256 414a476d837174d49bdce2beb21122c0c2614995265ad1e449af24994ac8ac6e
MD5 b6bb6505753219910b71c0ebcb2204af
SHA1 ae70e7e5cc7bc40bac554f4f18ea75025aa2a013
SHA512 eaab812532187cfdfe31e0b0121a9ca73f441cafb56e2f493fb4ea645d743c79ca894cb9d73a4e7f719ce7763b14b000f4519fa5149ba8aaf69e84b3877fc717
SSDEEP 24576:zlHC8sAUGwQVqI0Gk/TPgsZQMUxR+nO37/Z0NTtjny:EzI0d0sZQMUeO/Zgjny
TLSH
T1B84533534B7B0FC6B1F16AB5E9F44B43F58FD622987A35A719023FAF11042ECA5B4488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-39-0x0000000001280000-0x000000000128C000-memory.dmp

Download

memory/1752-28-0x0000000000A60000-0x0000000000DAA000-memory.dmp

Download

memory/1752-33-0x000000001B740000-0x000000001B74C000-memory.dmp

Download

memory/3432-40-0x000000001B1B0000-0x000000001B1D2000-memory.dmp

Download

memory/3432-41-0x00000000027B0000-0x00000000027BC000-memory.dmp

Download

memory/5948-81-0x0000000002410000-0x000000000241C000-memory.dmp

Download