asyncrat | 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc

Analysis

user interaction
yes
max time kernel
346s
max time network
351s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinNetSvc_e4a53f.exe
Size 202.7MB
Sample260418-phcspsht6q
SHA256 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc
MD5 6393a9b9173d447feda7166c5b605876
SHA1 09384613a83e1525d11baa0f994f09d653c6e759
SHA512 27b62ce2165a9e88915f9b6cd93878ce93a9c6ec0dcddc229729aaf28760d0761982ce547f89ec90a1ed9c0934825640f2ae28ae1faca6519ca9526e67177a0b
SSDEEP 3145728:6VPnE9X6KPuUxWacIC0Jh1W6zODQ9NqguZgnNR5hKe6Ls+4HXQNvqq:n9X6KPuTacCJG6IC/+s+Mcqq
TLSH
T131A8CF1163E86E45E27B8278977782A1D6B5BC525311C2CF0094FD4A3F73BC2BA36366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0003000000000701-26.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000701-26.dat	family_stormkitty
behavioral2/memory/3016-28-0x0000000000140000-0x000000000048A000-memory.dmp	family_stormkitty

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	almohtraf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WinNetSvc_b628c3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WinNetSvc_e4a53f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WinNetSvc_e1555d.exe

Executes dropped EXE 6 IoCs

pid	Process
3180	WinNetSvc_e1555d.exe
3016	almohtraf.exe
3468	almtmiz.exe
2356	almtmiz.exe
2588	WinNetSvc_b628c3.exe
3676	almohtraf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
900	cmd.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
1948	timeout.exe
4152	timeout.exe
5032	timeout.exe
3760	timeout.exe
4424	timeout.exe
3440	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2636	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3016	almohtraf.exe
3468	almtmiz.exe
3468	almtmiz.exe
3468	almtmiz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	WinNetSvc_e4a53f.exe
Token: SeDebugPrivilege	3180	WinNetSvc_e1555d.exe
Token: SeDebugPrivilege	3016	almohtraf.exe
Token: SeDebugPrivilege	3468	almtmiz.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2588	WinNetSvc_b628c3.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3052	WinNetSvc_e4a53f.exe
3052	WinNetSvc_e4a53f.exe
3180	WinNetSvc_e1555d.exe
3180	WinNetSvc_e1555d.exe
3468	almtmiz.exe
2588	WinNetSvc_b628c3.exe
2588	WinNetSvc_b628c3.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3180	3052	WinNetSvc_e4a53f.exe	94
PID 3052 wrote to memory of 3988	3052	WinNetSvc_e4a53f.exe	95
PID 3988 wrote to memory of 1948	3988	cmd.exe	97
PID 3988 wrote to memory of 980	3988	cmd.exe	98
PID 980 wrote to memory of 892	980	net.exe	99
PID 3988 wrote to memory of 3176	3988	cmd.exe	100
PID 3988 wrote to memory of 4152	3988	cmd.exe	101
PID 3988 wrote to memory of 3016	3988	cmd.exe	102
PID 3016 wrote to memory of 544	3016	almohtraf.exe	104
PID 3016 wrote to memory of 4420	3016	almohtraf.exe	106
PID 4420 wrote to memory of 5032	4420	cmd.exe	108
PID 544 wrote to memory of 4848	544	cmd.exe	109
PID 4420 wrote to memory of 2356	4420	cmd.exe	112
PID 3180 wrote to memory of 900	3180	WinNetSvc_e1555d.exe	113
PID 900 wrote to memory of 2636	900	cmd.exe	115
PID 900 wrote to memory of 3760	900	cmd.exe	117
PID 3180 wrote to memory of 2588	3180	WinNetSvc_e1555d.exe	118
PID 3180 wrote to memory of 4980	3180	WinNetSvc_e1555d.exe	119
PID 4980 wrote to memory of 4424	4980	cmd.exe	121
PID 4980 wrote to memory of 2500	4980	cmd.exe	122
PID 2500 wrote to memory of 2208	2500	net.exe	123
PID 4980 wrote to memory of 4332	4980	cmd.exe	124
PID 4980 wrote to memory of 3440	4980	cmd.exe	125
PID 4980 wrote to memory of 3676	4980	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe
"C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e1555d.exe
  "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e1555d.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c taskkill /F /IM "WinNetSvc_e4a53f.exe" & timeout /t 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "WinNetSvc_e4a53f.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:3760
- - C:\Users\Admin\AppData\Local\Temp\WinNetSvc_b628c3.exe
    "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_b628c3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:4424
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2208
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "WinServiceSyncTask" /F
      4⤵
      PID:4332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3440
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
      "almohtraf.exe"
      4⤵
      Executes dropped EXE
      PID:3676
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1948
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:892
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WinServiceSyncTask" /F
    3⤵
    PID:3176
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4152
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
    "almohtraf.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A83.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5032
    - - C:\Users\Admin\AppData\Roaming\almtmiz.exe
        
        "C:\Users\Admin\AppData\Roaming\almtmiz.exe"
        5⤵
        Executes dropped EXE
        
        PID:2356

C:\Users\Admin\AppData\Roaming\almtmiz.exe
"C:\Users\Admin\AppData\Roaming\almtmiz.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

almohtraf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\almohtraf.exe.log
Size 1KB
SHA256 c4690d5e4ba4d7d4bfe813b1f02aa535c2eb0e27bb097d2fe37fbcc66d29cecf
MD5 a6c9c7d8739b6b18b572dfa496509a1d
SHA1 febb2d6f97d9030dec365fa88c1d0bc48b4adb45
SHA512 92f45dab1626426fdc0ca73f19338dae7a46b8f8c28e1d9ba3719453118c5d7e21c395e7aa85dcbecb18103dfb000c395cacdd47c6ea7141d390fff7a16240c2
TLSH
T11D31CD712376F1D889163F462C6D2AC407BF0335BA90DE0CB5A8A25ED9364175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

02xv2hhg.hoy

Path C:\Users\Admin\AppData\Local\Temp\02xv2hhg.hoy
Size 474B
SHA256 240098e7033b5f20c8c5936ecb68cc1049f1ecc34af536995b52a93175249150
MD5 46f522c77d1a514703a7fed0015fc623
SHA1 ed22f0a5884ff7445f4e171e1e49e0af608e0fda
SHA512 09aec723bf6f79c3926300c64b9b70f67d7190fcb75d53b32ffd2d4803515dabb014cab50cf2924a366c0c73ac2187c4a393790cdf3d4b989146f6b310d3c90f
TLSH
T1BCF02E00C4D4E976477205913FEBF510576D132304C90A4578A4BDA79F955D64947075
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4A83.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4A83.tmp.bat
Size 151B
SHA256 5306ac684377646840879018ee90cbf293034641ba3b863462a3519378bc6d5c
MD5 92825da42823d861b28d77e50bfe84c5
SHA1 dd0450dc83bfcc53c56336b361562bfa1845d97e
SHA512 ef73d3130f4930d2f8e91e92fe512cd3e26ebd8988a07a80f67c60cb6abde20d1375b930214f37d9a24a542620e0907beaf07967a71c5e609e9c87b5cab540c4
TLSH
T1E7C02B4252C5EB7F7905246302FBD4CEB1766D5D3F40BF00D344448D2280468F0DA341
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat
Size 988B
SHA256 d710692ad33516739d9d492d494fb87054559d51f9f5de117dc9675d74d41c5c
MD5 684c0e1e40451ca9da7ec67358b53f01
SHA1 9a96498fadde3c37adeb142df1a58d2e12b1f24e
SHA512 0784137761157f370769ade0d27b6e4535c32c5cfedd085298521078660e979c93c7825246be58cbcf52f5eed5a215ca11ef27f23fe7c041c0d7676422eba53f
TLSH
T1341125511D2644121353BD76C2533455F4B99E131E16E458F4D350904FBF286D5CE6F6
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
Size 3.3MB
SHA256 8ce93a19ce487452698e76a063759f89281d241dc51bf2b2e62c6ed275dbfaaf
MD5 26280b3a6e26806d41644e9d6a54456e
SHA1 1c3d412f08b536744be948db3fb53b64050022a3
SHA512 72d97cb072192d56a01a610ae42b01d959a6fbcb9694393125e4ae2476fdf61f7699dbd630b2d73b6c02cca072742c5b8442366d87a90b9666984cf403c767e8
SSDEEP 49152:geMAR4e3jG7Pk12ShzPMAzU0mdBdo+6WuDayPtr/NJJc:gQ3y7TS9x
TLSH
T1F5F54B416BE8CE1BE1BF2775A4F201111BB1E449A732D78F1698E6792C637406D0A3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkg_data.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\pkg_data.dat
Size 1.2MB
SHA256 414a476d837174d49bdce2beb21122c0c2614995265ad1e449af24994ac8ac6e
MD5 b6bb6505753219910b71c0ebcb2204af
SHA1 ae70e7e5cc7bc40bac554f4f18ea75025aa2a013
SHA512 eaab812532187cfdfe31e0b0121a9ca73f441cafb56e2f493fb4ea645d743c79ca894cb9d73a4e7f719ce7763b14b000f4519fa5149ba8aaf69e84b3877fc717
SSDEEP 24576:zlHC8sAUGwQVqI0Gk/TPgsZQMUxR+nO37/Z0NTtjny:EzI0d0sZQMUeO/Zgjny
TLSH
T1B84533534B7B0FC6B1F16AB5E9F44B43F58FD622987A35A719023FAF11042ECA5B4488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-39-0x00000000031B0000-0x00000000031BC000-memory.dmp

Download

memory/3016-28-0x0000000000140000-0x000000000048A000-memory.dmp

Download

memory/3016-33-0x0000000002750000-0x000000000275C000-memory.dmp

Download

memory/3468-40-0x000000001C3A0000-0x000000001C3C2000-memory.dmp

Download

memory/3468-41-0x0000000003190000-0x000000000319C000-memory.dmp

Download

memory/3676-82-0x00000000031D0000-0x00000000031DC000-memory.dmp

Download